ManageEngine and Zoho Analytics Plus Active Directory Account Takeover Vulnerability

A vulnerability exists in Zoho Analytics On-Premise and ManageEngine Analytics Plus versions prior to 6130, allowing for Active Directory (AD) account takeover. This issue arises from a hardcoded sensitive token, which could lead to unauthorized access to AD user accounts and exposure of user information. The vulnerability specifically affects Windows installations that use AD authentication without Single Sign-On (SSO) configuration.

Impact

Exploitation of this vulnerability could result in unauthorized access to AD user accounts, allowing for account takeovers and exposure of sensitive user information.

Remediation

Users can upgrade to the latest version by downloading the upgrade pack from the ManageEngine or Zoho Analytics service pack pages and following the provided upgrade instructions.