CVE-2024-38869— Incorrect Authorization
Quick assessment
Affected
ManageEngine Endpoint Central
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ZOHO ManageEngine ServiceDesk Plus（SDP）和ZOHO ManageEngine SupportCenter Plus都是美国卓豪（ZOHO）公司的产品。ZOHO ManageEngine ServiceDesk Plus是一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。ZOHO ManageEngine SupportCenter Plus是一种基于 Web 的客户支持软件。用于让组织有效地管理客户
Possible ATT&CK Techniques 1 AI
T1133 · External Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-38869
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect Authorization
Source: CVE Program / CVE List V5
Vulnerability Description
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
ZOHO ManageEngine ServiceDesk Plus和SupportCenter Plus 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ZOHO ManageEngine ServiceDesk Plus（SDP）和ZOHO ManageEngine SupportCenter Plus都是美国卓豪（ZOHO）公司的产品。ZOHO ManageEngine ServiceDesk Plus是一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。ZOHO ManageEngine SupportCenter Plus是一种基于 Web 的客户支持软件。用于让组织有效地管理客户
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ManageEngine | Endpoint Central | 0 ~ 11.3.2416.04 | - |
|
II. Public POCs for CVE-2024-38869
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-38869
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-38869 (1)
Same Patch Batch · ManageEngine · 2024-08-23 · 11 CVEs total
| CVE-2024-5466 | 8.8 HIGH | Remote Code Execution |
| CVE-2024-5556 | 8.3 HIGH | SQL Injection |
| CVE-2024-5586 | 8.3 HIGH | SQL Injection |
| CVE-2024-5467 | 8.3 HIGH | SQL Injection |
| CVE-2024-5490 | 8.3 HIGH | SQL Injection |
| CVE-2024-36515 | 8.3 HIGH | SQL Injection |
| CVE-2024-36517 | 8.3 HIGH | SQL Injection |
| CVE-2024-36514 | 8.3 HIGH | SQL Injection |
| CVE-2024-36516 | 8.3 HIGH | SQL Injection |
| CVE-2024-41150 | 6.3 MEDIUM | Stored XSS |
IV. Related Vulnerabilities
Same weakness: CWE-863
-
CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resou -
CVE-2026-103626
Chrome <154.0.8037.97 文件系统权限验证漏洞 -
CVE-2026-104443
YesWiki before 4.6.7 Scope Bypass via Triples Delete API -
CVE-2026-82358
RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass -
CVE-2026-103758
Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-con
V. Comments for CVE-2024-38869
No comments yet