PT-2020-12669 · Zoho · Zoho Manageengine Datasecurity Plus

Sahil Dhar · Published 2020-05-08 · Updated 2022-10-13 · CVE-2020-11532

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine DataSecurity Plus versions prior to 6.0.1

Description The issue allows an attacker to bypass authentication for the DataEngine Xnode server and execute all operations in the context of the admin user, due to the use of default admin credentials for communication with the server.

Recommendations For versions prior to 6.0.1, update to version 6.0.1 or later to resolve the issue. As a temporary workaround, consider changing the default admin credentials used by Zoho ManageEngine DataSecurity Plus to communicate with the DataEngine Xnode server. Restrict access to the DataEngine Xnode server to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2020-11532

Affected Products

Zoho Manageengine Datasecurity Plus

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/manageengine_datasecurity_plus_xnode_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/manageengine_adaudit_plus_xnode_enum.rb · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/May/28 · Exploit
• 🔥 http://packetstormsecurity.com/files/157609/ManageEngine-DataSecurity-Plus-Authentication-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11532 · Security Note
• https://pitstop.manageengine.com/portal/community/topic/upgrade-datasecurity-plus-to-the-build-6013-to-fix-security-issues · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11532 · Vendor Advisory
• https://t.me/cvenotify/3688 · Telegram Post
• https://t.me/cybersecuritytechnologies/1094 · Telegram Post
• https://t.me/cybersecuritytechnologies/6968 · Telegram Post