PT-2020-14519 · Zoho · Zoho Application Control Plus

Dominique Righetto · Published 2020-09-29 · Updated 2024-12-18 · CVE-2020-15594

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho Application Control Plus versions prior to 10.0.511

Description A Server-Side Request Forgery (SSRF) issue was discovered in the mail gateway configuration feature, allowing an attacker to perform a scan and discover open ports on a machine as well as available machines on the network segment where the product is deployed.

Recommendations For versions prior to 10.0.511, update to version 10.0.511 or later to resolve the issue. As a temporary workaround, consider restricting access to the mail gateway configuration feature until a patch is applied.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-15594

Affected Products

Zoho Application Control Plus

References · 5

• https://osv.dev/vulnerability/CVE-2020-15594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15594 · Security Note
• https://t.me/cvenotify/104689 · Telegram Post
• https://excellium-services.com/cert-xlm-advisory/cve-2020-15594 · Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-15594 · Note