Medium severity · published Sep 30, 2020
CVE-2020-15595
An issue was discovered in Zoho Application Control Plus before version 10.0.511
4.3
CVSS
2.2%
EPSS
No
On KEV
Description
An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Manageengine Application Control Plus · Zohocorp
before 10.0.511 · source: NVD
Affected product
MA
Manageengine Application Control Plus
Zohocorp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15595
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15595
cds.thalesgroup.com
https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-15595
Exploit
https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595
More from Manageengine Application Control Plus
9.8
CVE-2022-47966
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
5.5
CVE-2023-6105
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed
4.3
CVE-2020-15594
An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511