CVE-2024-41140

CVE-2024-41140 is an incorrect authorization vulnerability (CWE-863) in the update user function of Zohocorp ManageEngine Applications Manager versions 174000 and prior. Published on 2025-01-29, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its potential for significant confidentiality and integrity impacts.

The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low complexity and no user interaction. Successful exploitation enables high-impact unauthorized access to confidentiality and integrity, such as modifying user data, while leaving availability unaffected and scope unchanged.

ManageEngine has published a security update advisory addressing this issue, available at https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2024-41140.html, which security practitioners should consult for patch details and mitigation guidance.