Critical severity · published Aug 31, 2020
CVE-2020-24786
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817,…
9.8
CVSS
12.8%
EPSS
No
On KEV
Description
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)12.8% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
ManageEngine ADSelfService Plus · Zoho
through 5.7; 5.8; 5.8; 5.8; 5.8; 5.8; +13 more · source: NVD
MA
Manageengine Ad360 · Zohocorp
through 4.1; 4.2; 4.2; 4.2; 4.2; 4.2; +19 more · source: NVD
MA
Manageengine Adaudit Plus · Zohocorp
through 5.1; 6.0; 6.0; 6.0; 6.0; 6.0; +6 more · source: NVD
MA
Manageengine Admanager Plus · Zohocorp
through 6.6; 7.0; 7.0; 7.0; 7.0; 7.0; +7 more · source: NVD
MC
Manageengine Cloud Security Plus · Zohocorp
through 4.0; 4.1; 4.1; 4.1; 4.1; 4.1; +5 more · source: NVD
MD
Manageengine Datasecurity Plus · Zohocorp
through 5.0; 6.0; 6.0; 6.0; 6.0; 6.0; +8 more · source: NVD
ME
Manageengine Eventlog Analyzer · Zohocorp
through 12.1.2; 12.1.3; 12.1.3 · source: NVD
ME
Manageengine Exchange Reporter Plus · Zohocorp
through 5.4; 5.5; 5.5; 5.5; 5.5; 5.5 · source: NVD
ML
Manageengine Log360 · Zohocorp
through 5.0; 5.1; 5.1; 5.1; 5.1; 5.1; +7 more · source: NVD
MO
Manageengine O365 Manager Plus · Zohocorp
through 4.2; 4.3; 4.3; 4.3; 4.3; 4.3; +24 more · source: NVD
MR
Manageengine Recovermanager Plus · Zohocorp
through 5.4; 6.0; 6.0; 6.0; 6.0; 6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-24786
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-24786
medium.com
https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-and-enhancements
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-17-5-2020
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-18-5-2020
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability
More from ManageEngine ADSelfService Plus
9.8
CVE-2022-47966
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
9.8
CVE-2022-35405
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
9.8
CVE-2021-40539
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
9.8
CVE-2020-10189
Zoho ManageEngine Desktop Central File Upload Vulnerability
6.8
CVE-2022-28810
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability