CVE-2020-11531 Path traversal in n/a
An authenticated attacker can exploit a path traversal vulnerability in Zoho ManageEngine DataSecurity Plus to write a JSP file and execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11531?
CVE-2020-11531 is a high-severity path traversal vulnerability in Zohocorp Manageengine Adaudit Plus, published on 8 May 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot directory via directory traversal.
Weakness: CWE-22
Which versions are affected by CVE-2020-11531?
It affects 2 products.
Products include Zohocorp Manageengine Adaudit Plus, Zohocorp Manageengine Datasecurity Plus.
How do I fix CVE-2020-11531?
No fix has been published for CVE-2020-11531 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-11531 being exploited?
There is no known exploitation of CVE-2020-11531 in the wild and no public exploit code.
Other vulnerabilities in Zohocorp Manageengine Adaudit Plus
Sources
Also known as GHSA-w3w2-3jp4-4c4g.