CVE-2020-24786

critical-risk
Published 2020-08-31

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.

Do I need to act?

~
6.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Zohocorp

References (24)

https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauth...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauth...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauth...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-m...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-m...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-m...
Vendor Advisory https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-cloud-securi...
Vendor Advisory https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-log360-secur...
Vendor Advisory https://www.manageengine.com/data-security/release-notes.html
Vendor Advisory https://www.manageengine.com/products/eventlog/features-new.html
https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauth...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauth...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauth...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-m...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-m...
Vendor Advisory https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-m...
and 4 more references
74
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 9/34 · Low
Exposure 33/34 · Critical