CVE-2023-41904

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Sep 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-419055.4NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user.CVE-2023-419085.3Cerebrate before 1.15 lacks the Secure attribute for the session cookie.CVE-2023-419097.5An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no atCVE-2023-41919.8A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. Affected by this issue isCVE-2023-419109.8An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remCVE-2023-419115.5Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2).CVE-2023-419139.8strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the intCVE-2023-419147.0SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwritCVE-2023-419158.1OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during executCVE-2023-419166.5In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in thCVE-2023-4191710.0Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by aCVE-2023-4191810.0A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated
CVE-2023-41904: Medium severity, CVSS 5.4 | Vulnix