PT-2022-8643 · Zoho · Manageengine Analytics Plus

Published 2022-08-15 · Updated 2022-08-16 · CVE-2020-21641

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Analytics Plus versions prior to 4.3.5

Description The issue allows remote attackers to read arbitrary files, enumerate folders, and scan internal ports via a crafted XML license file. This is due to an Out-of-Band XML External Entity (OOB-XXE) vulnerability.

Recommendations For versions prior to 4.3.5, update to version 4.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the XML license file to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-21641

Affected Products

Manageengine Analytics Plus

References · 4

• https://manageengine.com/analytics-plus/release-notes.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-21641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-21641 · Security Note
• https://t.me/cibsecurity/48186 · Telegram Post