CVE-2021-28959

CWE-22 — Path Traversal3 documents3 sources

Severity

9.8CRITICAL

EPSS

24.1%

top 3.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Eventlog Analyzer

Timeline

PublishedApr 30

Latest updateMay 24

Description

Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDzohocorp/manageengine_eventlog_analyzer< 12.1.4+1

🔴Vulnerability Details

GHSA

GHSA-jqhq-x433-j3xh: Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive↗2022-05-24

▶

CVEList

CVE-2021-28959: Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive↗2021-04-30

▶