Lucene search

[email protected]CVE-2020-15533

HistoryOct 01, 2020 - 7:15 p.m.

CVE-2020-15533

2020-10-0119:15:12

CWE-89

[email protected]

web.nvd.nist.gov

cve-2020-15533

zoho manageengine

application manager

sql injection

vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

80.9%

JSON

In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack.

Affected configurations

NVD

Node

zohocorpmanageengine_applications_managerRange<14.6

zohocorpmanageengine_applications_managerMatch14.6-

zohocorpmanageengine_applications_managerMatch14.6build14680

zohocorpmanageengine_applications_managerMatch14.6build14681

zohocorpmanageengine_applications_managerMatch14.6build14682

zohocorpmanageengine_applications_managerMatch14.6build14683

zohocorpmanageengine_applications_managerMatch14.6build14690

zohocorpmanageengine_applications_managerMatch14.7-

zohocorpmanageengine_applications_managerMatch14.7build14700

zohocorpmanageengine_applications_managerMatch14.7build14710

zohocorpmanageengine_applications_managerMatch14.7build14720

zohocorpmanageengine_applications_managerMatch14.7build14730

zohocorpmanageengine_applications_managerMatch14.7build14740

CPENameOperatorVersion
zohocorp:manageengine_applications_managerzohocorp manageengine applications managerlt14.6
zohocorp:manageengine_applications_managerzohocorp manageengine applications managereq14.7

CPE	Name	Operator	Version
zohocorp:manageengine_applications_manager	zohocorp manageengine applications manager	lt	14.6
zohocorp:manageengine_applications_manager	zohocorp manageengine applications manager	eq	14.7

References

www.manageengine.com

www.manageengine.com/products/applications_manager/issues.html#v14750

www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-15533.html

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

80.9%

JSON

Related for CVE-2020-15533

nvd1 cvelist1 prion1 checkpoint_advisories1