身份验证绕过

CVE-2026-3324 影响 ManageEngine Log360 的 13000 到 13013 版本。此身份验证绕过漏洞源于不正确的过滤器配置，允许未经授权或权限不足的用户在系统中执行某些操作。潜在影响包括日志数据篡改、未经授权访问敏感信息，以及在更严重的情况下，系统被破坏。CVSS 评分是 8.2，表明存在高风险。解决此漏洞对于保护日志数据的完整性和保密性至关重要。

Organizations heavily reliant on ManageEngine Log360 for centralized log management and security monitoring are particularly at risk. This includes those with extensive deployments of Log360 across multiple servers or environments, as well as those who have configured Log360 to collect sensitive data from critical systems. Shared hosting environments where multiple customers share the same Log360 instance are also vulnerable.

• manageengine: Examine Log360 access logs for unusual login patterns or attempts to access restricted resources.

journalctl -u log360 | grep "authentication bypass" 

• generic web: Monitor web server access logs for requests targeting Log360 endpoints with unusual parameters or headers.

curl -I <log360_url> | grep -i "authentication bypass"

1. 2026-04-16Disclosure

   disclosure

1. 已保留2026-02-27
2. 发布日期2026-04-16
3. EPSS 更新日期2026-04-24

解决 CVE-2026-3324 的方法是将 ManageEngine Log360 升级到 13.0.14 或更高版本。此更新将修复允许身份验证绕过的错误配置的过滤器。强烈建议尽快应用此更新，尤其是在日志数据安全至关重要的环境中。在升级之前，建议对系统进行完整备份，以降低升级过程中可能出现的任何风险。Zohocorp 已经在其支持网站上提供了有关如何执行升级的详细说明。