CVE-2020-15595

MEDIUM

Zoho Application Control Plus <10.0.511 - Info Disclosure

Title source: llm

Description

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access.

References (2)

Core 2

Core References

Various Sources

https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-15595

Exploit, Third Party Advisory

https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595

Scores

CVSS v3 4.3

EPSS 0.0218

EPSS Percentile 84.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

Status published

Products (1)

zohocorp/manageengine_application_control_plus < 10.0.511

Published Sep 30, 2020

Tracked Since Feb 18, 2026