CVE-2024-5546 is a high severity (CVSS 8.3) authenticated SQL injection in ManageEngine Password Manager Pro and PAM360, reachable through the global search option. Password Manager Pro is fixed in build 12431 and PAM360 in build 7001, both dated 14 June 2024. Apply the upgrade pack.
What's affected
The vendor advisory gives two fixed builds.
| Product | Affected builds | Fixed build | Fixed on |
|---|---|---|---|
| Password Manager Pro | up to 12430 | 12431 | 14 June 2024 |
| PAM360 | up to 7000 | 7001 | 14 June 2024 |
The NVD record says the same thing in different words: Password Manager Pro before 12431 and PAM360 before 7001. The injection point is the global search option. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, which means a network attacker with a low privilege account and no user interaction.
One detail from the vendor is worth reading closely. The advisory says an adversary could run custom queries and read database table entries, but that the dual encryption mechanism keeps access to sensitive items such as passwords restricted. That is the vendor's claim about its own design, and it is not something this post can verify. It does not remove the need to patch, since the vendor itself calls for an immediate upgrade.
How to check if you're exposed
Both products are installed on your own servers, so you check the installed build, not a package version. Open the web console and read the build number shown for the product, then compare it with 12431 for Password Manager Pro or 7001 for PAM360.
If you cannot reach the console, look at the upgrade history your administrators keep. The vendor ships these as upgrade packs, so the last pack applied tells you the build.
Because the flaw needs a signed in user, also review who holds a login. A privileged access manager usually has a short list of accounts, which helps. Look for accounts that belong to people who have left, and for service accounts nobody owns.
If you track software across many hosts, a continuous inventory makes this kind of check a query instead of a hunt. The demo below shows how an inventory and a vulnerability list fit together.
What to do now
- Take a backup of the application and its database.
- Download the upgrade pack for your product from the vendor links in the advisory: the Password Manager Pro upgrade pack or the PAM360 upgrade pack.
- Apply it following the pack instructions, then confirm the build is 12431 or higher, or 7001 or higher.
- Audit logins: remove stale accounts and confirm who can reach the web console from the network.
- Contact the vendor support addresses listed in the advisory if the upgrade does not apply cleanly.
Why it matters
CWE-89 is SQL injection: text typed by a user is joined into a database query, so the database cannot tell data from instructions. Search boxes are a classic place for it because they accept free text and feed it straight to a query.
The product class raises the stakes. A password manager and privileged access tool holds the keys to other systems. Even if the secrets are protected by a second layer, as the vendor says, the surrounding data such as account names, resource lists and audit records helps an attacker plan their next step. The record shows no CISA KEV listing, and the vendor does not report exploitation, so treat this as an urgent patch, not a confirmed incident.
Try it yourself
Here is how a vulnerability list, owners and fix status come together in one view.
Click through it at your own pace, or open it full screen.
Quick check
Does the vendor say passwords were exposed?
No. The advisory says the dual encryption mechanism keeps access to sensitive information such as passwords restricted, while still urging an immediate upgrade. Treat that as the vendor's statement, not an independent finding.
Is the search feature the only affected part?
The advisory names the global search option as the vulnerable function. The fix is delivered as a full build, so upgrade the whole product rather than looking for a single patch.
Sources
Last reviewed: 19 October 2026.
