CVE-2020-24786

Katalog CVE

CVSS 9.8 · Critical EPSS 12,8%

Kerentanan Improper Authentication pada zohocorp manageengine adselfservice plus, zohocorp manageengine exchange reporter plus +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.

Rincian

Terbit di NVD

31 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

12,8% peluang dieksploitasi; lebih tinggi dari 96,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 152 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-and-enhancements advisory vendor
• https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-... advisory vendor
• https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-... advisory vendor
• https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-... advisory vendor
• https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-pr... advisory vendor
• https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-pr... advisory vendor
• https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-pr... advisory vendor
• https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-cloud-security-plus-security-advisory-rega... advisory vendor
• https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-log360-security-advisory-regarding-unauthe... advisory vendor
• https://www.manageengine.com/data-security/release-notes.html advisory vendor
• https://www.manageengine.com/products/eventlog/features-new.html advisory vendor
• https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5