Hi there,

The security advisory addresses multiple security vulnerabilities  identified in ManageEngine PAM360.

Severity: High

Given the severity of these vulnerabilities, customers are strongly advised to upgrade to the latest build of PAM360 immediately.

The complete fix for this is now available in the below version,

Issue:

The following issues were discovered in PAM360:

1. SQL Injection vulnerabilities—These vulnerabilities can allow an adversary to execute custom queries and access the database table entries using the vulnerable request. To fix this, we have added proper validation and escaping special characters.

2. Sensitive Information Disclosure was observed in personal password export. We have fixed this issue by removing the exported file containing passwords from the server once the user has downloaded it.

What should customers do?

The latest version of PAM360 holds the recommended mitigation targeting the vulnerabilities.  

Steps to Upgrade:

• Download the latest upgrade pack from: https://www.manageengine.com/privileged-access-management/minor-upgrades.html

• Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above link.

Important note: We strongly recommend that you take a backup of your entire PAM360 installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, back up the PAM360 database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

If you have any questions or concerns, please contact our product support at

pam360-support@manageengine.com.

We express our sincerest apologies for any inconvenience this may have caused.

Regards,