CVE-2020-24786

CRITICAL

ManageEngine ADSelfService Plus < 5817 - Authentication Bypass via UpdateProductDetails Servlet

Title source: llm

Description

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.

References (12)

Core 12

Core References

Vendor Advisory x_refsource_misc

https://www.manageengine.com/data-security/release-notes.html

Vendor Advisory x_refsource_misc

https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-log360-security-advisory-regarding-unauthenticated-product-integration-vulnerability

Various Sources x_refsource_misc

https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5

Vendor Advisory x_refsource_misc

https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-and-enhancements

Vendor Advisory x_refsource_misc

https://pitstop.manageengine.com/portal/en/kb/articles/manageengine-cloud-security-plus-security-advisory-regarding-unauthenticated-product-integration-vulnerability

Vendor Advisory x_refsource_misc

https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability

Vendor Advisory x_refsource_misc

https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-18-5-2020

Vendor Advisory x_refsource_misc

https://www.manageengine.com/products/eventlog/features-new.html

Vendor Advisory x_refsource_misc

https://pitstop.manageengine.com/portal/en/community/topic/how-to-identify-and-mitigate-the-unauthenticated-product-integration-vulnerability-15-5-2020-1

Vendor Advisory x_refsource_misc

https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-18-5-2020

Vendor Advisory x_refsource_misc

https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability

Vendor Advisory x_refsource_misc

https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-17-5-2020

Scores

CVSS v3 9.8

EPSS 0.0678

EPSS Percentile 91.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-287

Status published

Products (6)

zohocorp/manageengine_ad360 4.2 4200 (24 CPE variants)

zohocorp/manageengine_ad360 < 4.1

zohocorp/manageengine_adaudit_plus 6.0 6000 (11 CPE variants)

zohocorp/manageengine_adaudit_plus < 5.1

zohocorp/manageengine_admanager_plus 7.0 7000 (12 CPE variants)

zohocorp/manageengine_admanager_plus < 6.6

Published Aug 31, 2020

Tracked Since Feb 18, 2026