CVE-2020-11531

CWE-22 — Path Traversal3 documents3 sources
Severity
8.8HIGH
EPSS
8.2%
top 7.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Zohocorp Manageengine Adaudit PlusZohocorp Manageengine Datasecurity Plus
Timeline
PublishedMay 8
Latest updateMay 24

Description

The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot directory via directory traversal.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-w3w2-3jp4-4c4g: The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6↗2022-05-24
▶
CVEList
CVE-2020-11531: The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6↗2020-05-08
▶