CVE-2020-35765

Опубликовано: 05 фев. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do.

Ссылки

https://www.manageengine.com
Vendor Advisory
https://www.manageengine.com/products/applications_manager/issues.html#v15000
Release Notes
Vendor Advisory
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-35765.html
Vendor Advisory
https://www.tenable.com/security/research/tra-2021-02
Exploit
Third Party Advisory
https://www.tenable.com/security/research/tra-2021-02
Exploit
Third Party Advisory
https://www.manageengine.com
Vendor Advisory
https://www.manageengine.com/products/applications_manager/issues.html#v15000
Release Notes
Vendor Advisory
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-35765.html
Vendor Advisory
https://www.tenable.com/security/research/tra-2021-02
Exploit
Third Party Advisory
https://www.tenable.com/security/research/tra-2021-02
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*

Версия до 14.9 (исключая)

cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:-:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14900:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14910:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14911:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14930:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01258

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-3645-fcrm-r5v6

github

больше 3 лет назад