How to identify and mitigate the unauthenticated product integration vulnerability?
Some versions of O365 Manager Plus have the unauthenticated change to integration system vulnerability. This article explains how you can identify if your O365 Manager Plus installation is affected, and fix it. It also offers the mitigation steps to protect your installation in case it is not affected.
What is the issue?
O365 Manager Plus had a vulnerable endpoint which allowed a user to integrate O365 Manager Plus with any other supported ManageEngine product, bypassing authentication. This could lead to data leak.
Which version of O365 Manager Plus is affected?
All O365 Manager Plus builds below 4334 are affected.
What is the severity level of the vulnerability?
This is a critical issue. As this vulnerability could be exploited without authentication, from any publicly exposed O365 Manager Plus installation, the risks posed could be critical.
Is there a fix for this issue?
Update the product to the latest build, 4334, using the service pack.
If you need further information, have any questions, or face any difficulties upgrading or performing the recommended steps, please get in touch with us at support@o365managerplus.com, or +1-844-245-1108 (toll free).
Sticky Posts
[KB] Manage Microsoft Teams with O365 Manager Plus
Just released earlier this year, Microsoft Teams a chat-based workspace in Office 365 is the latest collaboration tool from Microsoft. With Microsoft Teams, you can exchange messages and share files of any type. Though it may sound attractive, that file sharing feature turns ugly when highly confidential or malicious files are shared by accident or on purpose. In addition to Teams, third-party applications being integrated with Teams must also be monitored for obvious security reasons.Thankfully,[KB] Office 365 Auditing : 4 activities that you should never miss
Office 365 auditing is an effective way to get insights about user activities, and insider threats. Among the plethora of activities to be audited, there are four must-audit activities, that help you to identify the most common attacks like, brute-force attack, insider attack, elevation of privilege attack, etc. Below are those four important activities that must be audited: User accesses: Know who is accessing your Office 365 subscription, when, and from where. By establishing a baseline of normal[KB] Office 365 Group Membership Management
Groups are an easy way to send emails or assign permissions to users collectively. When new employees join your organization, all you have to do is add them to appropriate groups to grant them access to the required resources. Most of the time there will be multiple groups to which the new users must be added. But, the Office 365 portal does not have a provision to add users to multiple groups in one go. And, that's why you need a comprehensive Office 365 management solution that can fill in allOffice 365 mailbox delegation -2
In the previous post, we saw how to generate a report on Office 365 mailbox delegates and how to manage them in bulk easily with O365 Manager Plus. This week we will see how to audit the activities of mailbox delegates easily with O365 Manager Plus. Audit activities of mailbox delegates O365 Manager Plus provides a default audit profile called Activities by Mailbox Delegates which provides one click access to the required audit data. Note: Auditing must be enabled for mailboxes to view the audit[KB] Office 365 mailbox delegation - 1
In Exchange Online you can grant permission on any user's mailbox to other users to enable them to access the mailbox (the Full Access permission), or send email messages that appear to come from the mailbox (the Send As or Send on Behalf permissions). The users who are assigned these permissions on other mailboxes are called delegates. This article will explain how to grant permissions to users on other users' mailboxes, generate a report on all mailbox delegates. Reports on mailbox delegates O365
