PT-2020-14520 · Zoho · Zoho Application Control Plus

Dominique Righetto · Published 2020-09-29 · Updated 2024-12-18 · CVE-2020-15595

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Zoho Application Control Plus versions prior to 10.0.511

Description An issue in the Element Configuration feature of Zoho Application Control Plus allows an attacker to retrieve the list of IP ranges and subnets configured in the product. This enables the attacker to obtain information about the internal network cartography that the product has access to.

Recommendations For versions prior to 10.0.511, update to version 10.0.511 or later to resolve the issue. As a temporary workaround, consider restricting access to the Element Configuration feature to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2020-15595

Affected Products

Zoho Application Control Plus

References · 5

• 🔥 https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15595 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15595 · Vendor Advisory
• https://t.me/cvenotify/104690 · Telegram Post
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-15595 · Note