Hi there,

This security advisory is to let you know that a security vulnerability of high severity was detected in ManageEngine PAM360.

CVE ID: CVE-2024-5546

Severity: High.

What is the issue?

An SQL injection vulnerability was discovered in PAM360. We have fixed this issue, and the vulnerability no longer exists in the fixed version.

Version details

(Please note that this vulnerability applies to only those who have installed or upgraded to the above mentioned versions).

Impact:

This vulnerability allows an adversary to execute custom queries, and access the database table entries using the vulnerable request. However the dual encryption mechanism ensures that the access to sensitive information like passwords remains restricted.

For more details about this vulnerability, please click here.

What should customers do?

Given the severity of this vulnerability, customers are strongly advised to upgrade to the latest build of PAM360 immediately.

Steps to Upgrade:

1. Download the latest upgrade pack from the following links:

PAM360 - https://www.manageengine.com/privileged-access-    management/upgradepack.html

2. Apply the latest upgrade pack to your existing product installation as per the upgrade pack instructions provided in the above links.

Please contact our product support team for further details at the below mentioned email addresses:

PAM360: pam360-support@manageengine.com

Important note: We strongly recommend that you take a backup of your entire PAM360 installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, backup the PAM360 database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

Please ignore this message if you have already upgraded to the latest build of PAM360. We express our sincerest apologies for any inconvenience this may have caused.

Regards,