Hi,

This security advisory is to let you know that a security vulnerability of high severity was detected in ManageEngine PAM360. 

Severity: High.

What is the issue?

An authorization vulnerability was discovered in PAM360 by the internal security team. We have fixed this issue, and the vulnerability no longer exists in the fixed version.

 Version details

(Please note that this vulnerability applies to only those who have installed or upgraded to version 6600 on or before 10th April, 2024)

SHA256 values of affected builds and ppms
ManageEngine_PAM360_6500_6501_6510_6520_6530_6540_6541_to_6600.ppm - 0da3e9813571b2e267b6538ac29901ca267990f5af54c951e03ce84d13107411
ManageEngine_PAM360_64bit.bin - 604e4b0abf11820d810d7d66c71ed2e7341dab4c0ff4299234b72e00b45021c0
ManageEngine_PAM360_64bit.exe - 8f11f3ff195ade249d394008aa7c30a4cb2cfcff80ebc8c011175ea218b3d77a
ManageEngine_PAM360_MSP_64bit.bin - d4d617144121714f3e023ace6054242dbabce52b229025eb86d58706b64b26c0
ManageEngine_PAM360_MSP_64bit.exe - 78f25fc9289d90be5caab682dbf4a7c6f728f384586664ed15e3a13b10581632
ManageEngine_PasswordManager_Pro_12410_to_6600.ppm - 34be2ba6348c1472fd58bd0edca82e081bb539eac114384e768a885f9ed03634

Impact:

This vulnerability can allow non-admin users to perform privileged operations by sending crafted requests to the PAM360 server.
For more details about this vulnerability, please click here.

What should customers do?

Given the severity of this vulnerability, customers are strongly advised to upgrade to the latest build of PAM360 immediately.

Steps to Upgrade:

1. Download the latest upgrade pack from here.

2. Apply the latest upgrade pack to your existing product installation as per the upgrade pack instructions provided in the above link.

Please contact our product support team for further details at the below mentioned email address:

pam360-support@manageengine.com

Important note: We strongly recommend that you take a backup of your entire PAM360 installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, backup the PAM360 database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

Please ignore this mail if you have already upgraded to the latest build of PAM360. We express our sincerest apologies for any inconvenience this may have caused.

Regards,

Praveen