Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-24786

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.

Published

2020-08-31T15:15:10.870

Last Modified

2024-11-21T05:16:04.410

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

10.0

Impact Score

10.0

Weaknesses

Type: Primary
CWE-287

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	zohocorp	manageengine_adselfservice_plus	≤ 5.7	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_adselfservice_plus	5.8	Yes
Application	zohocorp	manageengine_exchange_reporter_plus	≤ 5.4	Yes
Application	zohocorp	manageengine_exchange_reporter_plus	5.5	Yes
Application	zohocorp	manageengine_exchange_reporter_plus	5.5	Yes
Application	zohocorp	manageengine_exchange_reporter_plus	5.5	Yes
Application	zohocorp	manageengine_exchange_reporter_plus	5.5	Yes
Application	zohocorp	manageengine_exchange_reporter_plus	5.5	Yes
Application	zohocorp	manageengine_ad360	≤ 4.1	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_ad360	4.2	Yes
Application	zohocorp	manageengine_datasecurity_plus	≤ 5.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_datasecurity_plus	6.0	Yes
Application	zohocorp	manageengine_recovermanager_plus	≤ 5.4	Yes
Application	zohocorp	manageengine_recovermanager_plus	6.0	Yes
Application	zohocorp	manageengine_recovermanager_plus	6.0	Yes
Application	zohocorp	manageengine_recovermanager_plus	6.0	Yes
Application	zohocorp	manageengine_recovermanager_plus	6.0	Yes
Application	zohocorp	manageengine_recovermanager_plus	6.0	Yes
Application	zohocorp	manageengine_eventlog_analyzer	≤ 12.1.2	Yes
Application	zohocorp	manageengine_eventlog_analyzer	12.1.3	Yes
Application	zohocorp	manageengine_eventlog_analyzer	12.1.3	Yes
Application	zohocorp	manageengine_adaudit_plus	≤ 5.1	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_adaudit_plus	6.0	Yes
Application	zohocorp	manageengine_o365_manager_plus	≤ 4.2	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_o365_manager_plus	4.3	Yes
Application	zohocorp	manageengine_cloud_security_plus	≤ 4.0	Yes
Application	zohocorp	manageengine_cloud_security_plus	4.1	Yes
Application	zohocorp	manageengine_cloud_security_plus	4.1	Yes
Application	zohocorp	manageengine_cloud_security_plus	4.1	Yes
Application	zohocorp	manageengine_cloud_security_plus	4.1	Yes
Application	zohocorp	manageengine_cloud_security_plus	4.1	Yes
Application	zohocorp	manageengine_cloud_security_plus	4.1	Yes
Application	zohocorp	manageengine_cloud_security_plus	4.1	Yes
Application	zohocorp	manageengine_cloud_security_plus	4.1	Yes
Application	zohocorp	manageengine_cloud_security_plus	4.1	Yes
Application	zohocorp	manageengine_cloud_security_plus	4.1	Yes
Application	zohocorp	manageengine_admanager_plus	≤ 6.6	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	7.0	Yes
Application	zohocorp	manageengine_log360	≤ 5.0	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes
Application	zohocorp	manageengine_log360	5.1	Yes

References

https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5 ([email protected])
https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-and-enhancements Vendor Advisory ([email protected])
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability Vendor Advisory ([email protected])
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-17-5-2020 Vendor Advisory ([email protected])
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-18-5-2020 Vendor Advisory ([email protected])
https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability Vendor Advisory ([email protected])
https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-15-5-2020-1 Vendor Advisory ([email protected])
https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-18-5-2020 Vendor Advisory ([email protected])
https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-cloud-security-plus-security-advisory-regarding-unauthenticated-product-integration-vulnerability Vendor Advisory ([email protected])
https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-log360-security-advisory-regarding-unauthenticated-product-integration-vulnerability Vendor Advisory ([email protected])
https://www.manageengine.com/data-security/release-notes.html Vendor Advisory ([email protected])
https://www.manageengine.com/products/eventlog/features-new.html Vendor Advisory ([email protected])
https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5 (af854a3a-2127-422b-91ae-364da2661108)
https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-and-enhancements Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-17-5-2020 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-18-5-2020 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-15-5-2020-1 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-18-5-2020 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-cloud-security-plus-security-advisory-regarding-unauthenticated-product-integration-vulnerability Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-log360-security-advisory-regarding-unauthenticated-product-integration-vulnerability Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.manageengine.com/data-security/release-notes.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.manageengine.com/products/eventlog/features-new.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)