CVE-2019-20474 Server-side request forgery in n/a

Medium 4.3 Published 17 Feb 2020 Updated 5 Aug 2024

Guest users can exploit a mail-server configuration test feature to perform SSRF attacks, scanning internal networks and hosts.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-20474?

CVE-2019-20474 is a medium-severity server-side request forgery vulnerability in n/a, published on 17 Feb 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role (read-only access) to use and abuse it. One of the abuses allows performing network and port scan operations of the localhost or the hosts on the same network segment, aka SSRF.

Weakness: CWE-918

Which versions are affected by CVE-2019-20474?

It affects 1 product.

Products include Zohocorp Manageengine Remote Access Plus.

How do I fix CVE-2019-20474?

No fix has been published for CVE-2019-20474 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2019-20474 being exploited?

There is no known exploitation of CVE-2019-20474 in the wild and no public exploit code.

Sources

Also known as GHSA-h34j-f5r2-pcx7.