Read the docs
TI-2023-26947 Aliases CVE-2023-49333GHSA-7chq-mr2c-3p6c

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.

Priority MEDIUM 46CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03005 87th percentileScored 2026-11-07
Fix Fixed ADAudit Plus (ManageEngine): 7271

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ManageEngineADAudit Plusbefore 72717271Patch availableCNA
  • ADAudit Plus VendorManageEngine Affected before 7271 Fixed in 7271 Patch available CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*before 7.2VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7200:*:*:*:*:*:*7.2 7200VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7201:*:*:*:*:*:*7.2 7201VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7202:*:*:*:*:*:*7.2 7202VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7203:*:*:*:*:*:*7.2 7203VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7210:*:*:*:*:*:*7.2 7210VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7211:*:*:*:*:*:*7.2 7211VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7212:*:*:*:*:*:*7.2 7212VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7213:*:*:*:*:*:*7.2 7213VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7215:*:*:*:*:*:*7.2 7215VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:* Versions before 7.2 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7200:*:*:*:*:*:* Versions 7.2 7200 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7201:*:*:*:*:*:* Versions 7.2 7201 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7202:*:*:*:*:*:* Versions 7.2 7202 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7203:*:*:*:*:*:* Versions 7.2 7203 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7210:*:*:*:*:*:* Versions 7.2 7210 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7211:*:*:*:*:*:* Versions 7.2 7211 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7212:*:*:*:*:*:* Versions 7.2 7212 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7213:*:*:*:*:*:* Versions 7.2 7213 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7215:*:*:*:*:*:* Versions 7.2 7215 Vulnerable ·Zohocorp
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7220:*:*:*:*:*:*7.2 7220VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7250:*:*:*:*:*:*7.2 7250VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7251:*:*:*:*:*:*7.2 7251VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7260:*:*:*:*:*:*7.2 7260VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7270:*:*:*:*:*:*7.2 7270VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7220:*:*:*:*:*:* Versions 7.2 7220 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7250:*:*:*:*:*:* Versions 7.2 7250 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7251:*:*:*:*:*:* Versions 7.2 7251 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7260:*:*:*:*:*:* Versions 7.2 7260 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.2:7270:*:*:*:*:*:* Versions 7.2 7270 Vulnerable ·Zohocorp

Remediation

  • Fix · CNA ADAudit Plus (ManageEngine) Fixed in 7271

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ManageEngine ADAudit Plus 7271

    6 records Highest priority Priority MEDIUM 6 MEDIUM

    Other records, highest priority first

    • TI-2023-26949 Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details.Priority MEDIUM 46
    • TI-2023-26948 Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.Priority MEDIUM 46
    • TI-2023-26946 Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.Priority MEDIUM 46
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49333
  2. 2026-10-03 Alias added: GHSA-7chq-mr2c-3p6c

References

Advisory 1

  • TI-2015-06796 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows… CVSS 3.0CRITICAL 9.8
  • TI-2014-04325 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer… CVSS 3.0HIGH 8.8
  • TI-2017-08514 Path traversal in Zoho ManageEngine ServiceDesk CVSS 3.0HIGH 7.5
  • TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
  • TI-2025-03383 SQL injection in ManageEngine ADSelfService Plus CVSS 3.1HIGH 8.1
  • TI-2025-24864 SQL injection in ManageEngine ADAudit Plus CVSS 3.1HIGH 8.3
See all 131 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences