ManageEngine PAM360, Password Manager Pro, and Access Manager Plus Authorization Vulnerability in Remote Session Initiation

An authorization vulnerability has been identified in ManageEngine PAM360 (versions prior to 8202), Password Manager Pro (versions prior to 13221), and Access Manager Plus (versions prior to 4401). This vulnerability allows authenticated users to initiate remote sessions to any resource managed by these applications. The issue arises only if the resources are accessible from the server where the application is installed.

Impact

Exploitation of this vulnerability allows unauthorized access to initiate remote sessions on resources managed by the affected application.

Remediation

Users can upgrade to the latest version of PAM360, Password Manager Pro, or Access Manager Plus. Upgrade packs are available on the ManageEngine website. For further assistance, contact ManageEngine product support via email.