10

CVE-2020-24786

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update -
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5800
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5801
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5802
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5803
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5804
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5805
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5806
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5807
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5808
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5809
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5810
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5811
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5812
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5813
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5814
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5815
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5816
Zohocorp ≫ Manageengine Exchange Reporter Plus Version 5.5 Update 5500
Zohocorp ≫ Manageengine Exchange Reporter Plus Version 5.5 Update 5501
Zohocorp ≫ Manageengine Exchange Reporter Plus Version 5.5 Update 5502
Zohocorp ≫ Manageengine Exchange Reporter Plus Version 5.5 Update 5503
Zohocorp ≫ Manageengine Exchange Reporter Plus Version 5.5 Update 5504
Zohocorp ≫ Manageengine Ad360 Version <= 4.1
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4200
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4201
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4202
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4203
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4204
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4205
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4206
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4207
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4208
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4209
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4210
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4212
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4213
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4214
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4215
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4216
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4217
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4219
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4220
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4222
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4223
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4224
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4225
Zohocorp ≫ Manageengine Ad360 Version 4.2 Update 4227
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6000
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6001
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6002
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6003
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6010
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6011
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6012
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6013
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6020
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6021
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6030
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6031
Zohocorp ≫ Manageengine Datasecurity Plus Version 6.0 Update 6032
Zohocorp ≫ Manageengine Recovermanager Plus Version 6.0 Update 6001
Zohocorp ≫ Manageengine Recovermanager Plus Version 6.0 Update 6003
Zohocorp ≫ Manageengine Recovermanager Plus Version 6.0 Update 6005
Zohocorp ≫ Manageengine Recovermanager Plus Version 6.0 Update 6011
Zohocorp ≫ Manageengine Recovermanager Plus Version 6.0 Update 6016
Zohocorp ≫ Manageengine Eventlog Analyzer Version 12.1.3 Update 12130
Zohocorp ≫ Manageengine Eventlog Analyzer Version 12.1.3 Update 12135
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6000
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6001
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6002
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6003
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6010
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6030
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6031
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6032
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6033
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6050
Zohocorp ≫ Manageengine Adaudit Plus Version 6.0 Update 6052
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4300
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4301
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4302
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4303
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4304
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4305
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4306
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4308
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4309
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4310
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4311
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4312
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4316
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4317
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4318
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4319
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4320
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4321
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4322
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4324
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4325
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4327
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4328
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4329
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4330
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4331
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4332
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4333
Zohocorp ≫ Manageengine O365 Manager Plus Version 4.3 Update 4334
Zohocorp ≫ Manageengine Cloud Security Plus Version 4.1 Update 4100
Zohocorp ≫ Manageengine Cloud Security Plus Version 4.1 Update 4101
Zohocorp ≫ Manageengine Cloud Security Plus Version 4.1 Update 4102
Zohocorp ≫ Manageengine Cloud Security Plus Version 4.1 Update 4103
Zohocorp ≫ Manageengine Cloud Security Plus Version 4.1 Update 4104
Zohocorp ≫ Manageengine Cloud Security Plus Version 4.1 Update 4105
Zohocorp ≫ Manageengine Cloud Security Plus Version 4.1 Update 4106
Zohocorp ≫ Manageengine Cloud Security Plus Version 4.1 Update 4107
Zohocorp ≫ Manageengine Cloud Security Plus Version 4.1 Update 4108
Zohocorp ≫ Manageengine Cloud Security Plus Version 4.1 Update 4109
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7000
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7010
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7011
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7020
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7030
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7040
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7041
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7050
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7051
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7052
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7053
Zohocorp ≫ Manageengine Admanager Plus Version 7.0 Update 7054
Zohocorp ≫ Manageengine Log360 Version <= 5.0
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5100
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5102
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5107
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5108
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5110
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5111
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5120
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5150
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5154
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5155
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5160
Zohocorp ≫ Manageengine Log360 Version 5.1 Update 5164
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 12.82% 0.958
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://www.manageengine.com/data-security/release-notes.html
Vendor Advisory
https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5
https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-and-enhancements
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-17-5-2020
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-18-5-2020
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-15-5-2020-1
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-18-5-2020
Vendor Advisory
https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-cloud-security-plus-security-advisory-regarding-unauthenticated-product-integration-vulnerability
Vendor Advisory
https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-log360-security-advisory-regarding-unauthenticated-product-integration-vulnerability
Vendor Advisory
https://www.manageengine.com/products/eventlog/features-new.html
Vendor Advisory