CVE-2020-24786 Auth bypass in n/a
Remote attackers can bypass authentication via a Java servlet to modify system properties and compromise the entire ManageEngine suite.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-24786?
CVE-2020-24786 is a critical authentication bypass vulnerability in Zohocorp Manageengine Adaudit Plus, published on 31 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.
Weakness: CWE-287
Which versions are affected by CVE-2020-24786?
It affects 11 products.
Products include Zohocorp Manageengine Ad360, Zohocorp Manageengine Adaudit Plus, Zohocorp Manageengine Admanager Plus, Zohocorp Manageengine Adselfservice Plus, Zohocorp Manageengine Cloud Security Plus, Zohocorp Manageengine Datasecurity Plus and 5 more.
How do I fix CVE-2020-24786?
No fix has been published for CVE-2020-24786 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-24786 being exploited?
There is no known exploitation of CVE-2020-24786 in the wild and no public exploit code.
Other vulnerabilities in Zohocorp Manageengine Adaudit Plus
Sources
Also known as GHSA-7w2m-j6h7-9f2m.