CVE-2021-20109

CWE-787 — Out-of-bounds WriteCWE-295 — Improper Certificate Validation4 documents4 sources
Severity
7.5HIGH
EPSS
2.8%
top 13.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Zohocorp Manageengine Assetexplorer
Timeline
PublishedJul 19
Latest updateMay 24

Description

Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

3
GHSA
GHSA-3683-2c96-6v5c: Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the A↗2022-05-24
▶
CVEList
CVE-2021-20109: Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the A↗2021-07-19
▶
OSV
CVE-2021-20109: Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the A↗2021-07-19
▶
CVE-2021-20109 (HIGH CVSS 7.5) | Due to the Asset Explorer agent not | cvebase.io