M365 Manager Plus 4417 Security Fix Release
Security Advisory
- We have fixed an authentication bypass vulnerability affecting a few REST API URLs used for integration in M365 Manager Plus. This article provides more information on the issue and how to resolve it.
What is the issue?
- An authentication bypass vulnerability affecting a few REST API URLs, that allowed unauthenticated users to access certain REST APIs.
What is the severity of this issue?
- This is a critical issue.
Which versions of M365 Manager Plus are affected?
- M365 Manager Plus builds up to 4416 are affected.
How does it impact M365 Manager Plus customers?
- This vulnerability allows an attacker to gain unauthorized access to the product through REST API endpoints that integrate ManageEngine M365 Manager Plus and ManageEngine AD360 by sending a specially crafted request. This would allow the attacker to carry out subsequent attacks.
What should I do if my installation is affected?
- Update M365 Manager Plus to the latest build, 4417, using the service pack.
If you need further information, have any questions, or face any difficulties updating M365 Manager Plus, please get in touch with us at m365managerplus-support@manageengine.com, or +1-408-916-9836 (toll free).
Sticky Posts
[ManageEngine] Free workshop series on O365 Manager Plus
Hi there, Do you find yourself struggling to manage the different Office 365 services your organization uses with just the native tools? We've got your back! O365 Manager Plus helps you audit, monitor, manage, and report on Exchange Online, Azure AD, and several other Office 365 services. Attend this free workshop series to find out how you can get the most out of O365 Manager Plus. Register now Agenda: Session Title Date & Time AnalyzeO365 Manager Plus User Conference: 2 days of extensive training
Join us for 2 days of learning and fun at our User Conference! During this conference, we will explore ways to help you make the best use of our Office 365 reporting, managing, monitoring, auditing, and alerting solution. You have the option of joining us in Sydney or in Melbourne. <<Learn more and register now>> By attending, you can learn in depth about: Gain real insight into Office 365. Office 365 auditing and compliance management. Office 365 management and help desk delegation made easy.O365 Manager Plus Free Online Webinar - Register Now!
Hello ! How sure are you in securing your Office 365 setup from sophisticated attacks? One sure shot way of defending attacks on your Office 365 platform is to use a solution that provides additional security measures which are not available natively in Office 365. Join us in our next webinar and learn how to cope with the security risks by taking advantage of O365 Manager Plus' features. Topic: Thwart Threats with O365 Manager Plus Date: November 9, 2017 Time: 2 PM EST Presenter: Anupriya[KB] Help Desk Delegation - Create Custom Help Desk Roles
Delegating mundane tasks to help desk technicians or concerned personnel reduces the burden of administrators. With Microsoft's Office 365 administrative console, it is either give access to everything or none. This is not much user-friendly, as you are not allowed to selectively delegate tasks to technicians. A HR personnel should not have access to financial reports. Similarly , front desk technician should not be allowed to add new users. When given full access, the users may knowingly or unknowinglyTrack Microsoft Teams with the all new O365 Manager Plus!
Hello Everybody! We’ve released today a new build of O365 Manager Plus - 4103. The new update supports Microsoft Teams and enhances product’s license management. What’s new? Feature: Microsoft Teams audit and alert : Two audit and alert categories have been added for Microsoft Teams. Microsoft Teams Events: Track events such as channels added, teams created, teams deleted, and users signed in to Teams. Microsoft Teams Settings Changes: Shows the details of channel changes, team changes, and organization
