PT-2021-3766 · Zoho · Zoho Manageengine Assetexplorer

David Wells · Published 2021-07-19 · Updated 2021-07-28 · CVE-2021-20109

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine AssetExplorer (affected versions not specified)

Description The issue is related to the Asset Explorer agent not validating HTTPS certificates, allowing an attacker on the network to send a NEWSCAN request to a listening agent and receive the agent's HTTP request verifying its authtoken. In the AEAgent.cpp file, the agent is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using the vswprintf function and written to a buffer that is only 0x2000 bytes big. If the POST payload is larger, a heap overflow will occur.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Memory Corruption

Weakness Enumeration

CWE-295

CWE-787

Related Identifiers

BDU:2021-04021

CVE-2021-20109

Affected Products

Zoho Manageengine Assetexplorer

References · 10

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20109 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20109 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20109 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-20109 · Security Note
• https://ubuntu.com/security/CVE-2021-20109 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04021 · Security Note
• https://tenable.com/security/research/tra-2021-30 · Note
• https://t.me/cvenotify/17842 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021072109 · Note
• https://t.me/cvenotify/18247 · Telegram Post