CVE-2024-38869: 
Zoho ManageEngine ServiceDesk Plus vulnerability analysis and mitigation

Zohocorp ManageEngine Endpoint Central was affected by an incorrect authorization vulnerability in remote office deploy configurations. The vulnerability, identified as CVE-2024-38869, was discovered by Jayateertha Guruprasad through the ManageEngine Bug bounty program and disclosed on June 30, 2024. The issue affects Endpoint Central versions before 11.3.2416.04 and before 11.3.2400.25 (ManageEngine Security).

The vulnerability stems from misconfigured API scope parameters for technician roles, which allowed technicians to deploy configurations to remote offices beyond their designated scope. The issue has been assigned a CVSS v3.1 base score of 8.3 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, indicating a serious security concern. The vulnerability is classified under CWE-863 (Incorrect Authorization) (NVD Database).

The vulnerability could allow technicians to bypass access control mechanisms and deploy configurations to remote offices outside their authorized scope. This could potentially lead to unauthorized system modifications and compromise of security controls across the organization's infrastructure (ManageEngine Security).

ManageEngine has released patches to address this vulnerability. Organizations using Enterprise version 11.3.2400.22 or below should upgrade to 11.3.2400.25, while those using version 11.3.2416.03 or below should upgrade to 11.3.2416.04. The fix implements proper access control mechanisms and is available for both On-Premises and Cloud versions (ManageEngine Security).