ManageEngine Log360 Authentication Bypass Vulnerability in V1 API

An authentication bypass vulnerability has been identified in ManageEngine Log360, affecting versions 13000 through 13013. This vulnerability arises from improper filter configuration, which allows certain actions to bypass authentication requirements. As a result, unauthorized users may gain access to restricted data and operations via the exposed V1 APIs.

Impact

Exploitation of this vulnerability allows for authentication bypass on the exposed V1 APIs, potentially leading to unauthorized access to data and operations.

Remediation

Users can update to Log360 build 13017 or the latest version using the available service pack. Instructions for downloading the service pack are available on the ManageEngine Log360 website.