Read the docs
TI-2019-12766 Aliases CVE-2019-17112GHSA-rjch-hj8f-vm5c

An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012.

Priority LOW 24CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-552.

Summary

An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access the configuration file of the mail server (except for the password).

Why it matters now

EPSS 0.02122 81st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.0:4000:*:*:*:*:*:*4.0 4000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.0:4002:*:*:*:*:*:*4.0 4002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.0:4010:*:*:*:*:*:*4.0 4010VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.0:4015:*:*:*:*:*:*4.0 4015VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.0:4016:*:*:*:*:*:*4.0 4016VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.1:4100:*:*:*:*:*:*4.1 4100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.1:4101:*:*:*:*:*:*4.1 4101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.1:4110:*:*:*:*:*:*4.1 4110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.1:4111:*:*:*:*:*:*4.1 4111VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.1:4120:*:*:*:*:*:*4.1 4120VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.0:4000:*:*:*:*:*:* Versions 4.0 4000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.0:4002:*:*:*:*:*:* Versions 4.0 4002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.0:4010:*:*:*:*:*:* Versions 4.0 4010 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.0:4015:*:*:*:*:*:* Versions 4.0 4015 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.0:4016:*:*:*:*:*:* Versions 4.0 4016 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.1:4100:*:*:*:*:*:* Versions 4.1 4100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.1:4101:*:*:*:*:*:* Versions 4.1 4101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.1:4110:*:*:*:*:*:* Versions 4.1 4110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.1:4111:*:*:*:*:*:* Versions 4.1 4111 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.1:4120:*:*:*:*:*:* Versions 4.1 4120 Vulnerable ·Zohocorp
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.2:4200:*:*:*:*:*:*4.2 4200VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.2:4201:*:*:*:*:*:*4.2 4201VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.2:4210:*:*:*:*:*:*4.2 4210VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.2:4211:*:*:*:*:*:*4.2 4211VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.3:4300:*:*:*:*:*:*4.3 4300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.3:4301:*:*:*:*:*:*4.3 4301VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.3:4302:*:*:*:*:*:*4.3 4302VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5000:*:*:*:*:*:*5.0 5000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5001:*:*:*:*:*:*5.0 5001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5002:*:*:*:*:*:*5.0 5002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5003:*:*:*:*:*:*5.0 5003VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5004:*:*:*:*:*:*5.0 5004VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5010:*:*:*:*:*:*5.0 5010VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5011:*:*:*:*:*:*5.0 5011VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.2:4200:*:*:*:*:*:* Versions 4.2 4200 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.2:4201:*:*:*:*:*:* Versions 4.2 4201 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.2:4210:*:*:*:*:*:* Versions 4.2 4210 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.2:4211:*:*:*:*:*:* Versions 4.2 4211 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.3:4300:*:*:*:*:*:* Versions 4.3 4300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.3:4301:*:*:*:*:*:* Versions 4.3 4301 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:4.3:4302:*:*:*:*:*:* Versions 4.3 4302 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5000:*:*:*:*:*:* Versions 5.0 5000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5001:*:*:*:*:*:* Versions 5.0 5001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5002:*:*:*:*:*:* Versions 5.0 5002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5003:*:*:*:*:*:* Versions 5.0 5003 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5004:*:*:*:*:*:* Versions 5.0 5004 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5010:*:*:*:*:*:* Versions 5.0 5010 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:5.0:5011:*:*:*:*:*:* Versions 5.0 5011 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-17112
  2. 2026-10-03 Alias added: GHSA-rjch-hj8f-vm5c

References

Advisory 2

  • TI-2020-09251 Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to… CVSS 3.1CRITICAL 9.8
  • TI-2020-15194 An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number… CVSS 3.1CRITICAL 9.8
  • TI-2020-09250 The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to… CVSS 3.1HIGH 8.8
  • TI-2023-17875 Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and… CVSS 3.1HIGH 8.1
  • TI-2023-05614 ManageEngine Information Disclosure in Multiple Products CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences