CVE:CVE-2023-29084
CNNVD:CNNVD-202304-1077
ZOHO ManageEngine ADManager Plus是美国卓豪（ZOHO）公司的一套为使用Windows域的企业用户设计的微软活动目录管理软件。该软件能够协助AD管理员和帮助台技术人员进行日常管理工作，例如批量管理用户帐户和AD对象、给帮助台技术员指派基于角色的访问权限等。
ZOHO ManageEngine ADManager Plus 7180版本及之前版本存在命令注入漏洞。攻击者利用该漏洞通过代理设置执行命令注入攻击。
solution:Upgrade zohocorp manageengine_admanager_plus to a higher version than 7.1,7.1:7100,7.1:7101,7.1:7102,7.1:7110,7.1:7111,7.1:7112,7.1:7113,7.1:7114,7.1:7115,7.1:7116,7.1:7117,7.1:7118,7.1:7120,7.1:7121,7.1:7122,7.1:7123,7.1:7124,7.1:7125,7.1:7126,7.1:7130,7.1:7131,7.1:7140,7.1:7141,7.1:7150,7.1:7151,7.1:7160,7.1:7161,7.1:7162,7.1:7163,7.1:7170,7.1:7171,7.1:7180,and avoid the version (,7.1),7.1:7100,7.1:7101,7.1:7102,7.1:7110,7.1:7111,7.1:7112,7.1:7113,7.1:7114,7.1:7115,7.1:7116,7.1:7117,7.1:7118,7.1:7120,7.1:7121,7.1:7122,7.1:7123,7.1:7124,7.1:7125,7.1:7126,7.1:7130,7.1:7131,7.1:7140,7.1:7141,7.1:7150,7.1:7151,7.1:7160,7.1:7161,7.1:7162,7.1:7163,7.1:7170,7.1:7171,7.1:7180