CVE-2025-8324

Full vulnerability record from the local CVENow database.

Description

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.

Severity

CRITICAL

CVSS score

9.8 (v3.1)

Vulnerability status

Deferred

Source identifier

0fc0942c-577d-436f-ae8e-945763c79b02

Published

2025-11-11 13:15:45.443000

Last modified

2026-10-18 21:10:00.120000

View original CVE JSON

{
  "id": "CVE-2025-8324",
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02",
  "published": "2025-11-11T13:15:45.443",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration."
    },
    {
      "lang": "es",
      "value": "Zohocorp ManageEngine Analytics Plus versiones 6170 e inferiores son vulnerables a una inyección SQL no autenticada debido a la configuración incorrecta del filtro."
    }
  ],
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "Zohocorp",
          "product": "ManageEngine Analytics Plus",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "6171",
              "versionType": "6171",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-13T04:55:24.080236Z",
          "id": "CVE-2025-8324",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.manageengine.com/analytics-plus/CVE-2025-8324.html",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    }
  ]
}