Unscored CVE-2016-1159 EUVD-2016-2263GHSA-f46c-2gwh-ff9p

In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive informat…

Published Mar 9, 2020 · Updated Aug 5, 2024 · Assigned by jpcert

Vendor: Zoho Product: Password Manager Pro (PMP)

Description

In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive information (entry password history) via a vulnerable hidden service.

Affected products

Vendor	Product	Affected	Fixed
ZOHO	Password Manager Pro (PMP)	8.3.0 (Build 8303, 8.4.0 (Build 8400, 8401, 8402).	—

References

https://excellium-services.com/cert-xlm-advisory/cve-2016-1159/
https://www.manageengine.com/products/passwordmanagerpro/release-notes.html
http://jvn.jp/vu/JVNVU90405898/index.html
https://www.manageengine.com/products/passwordmanagerpro/issues-fixed.html