Path Traversal Vulnerability in Zoho ManageEngine DataSecurity Plus

CVE-2020-11531

What is CVE-2020-11531?

The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to version 6.0.1 contains a path traversal vulnerability that stems from improper validation of database schema names during DR-SCHEMA-SYNC requests. This flaw permits an authenticated attacker to execute arbitrary code within the product's context by exploiting directory traversal to write a JSP file directly to the webroot directory. This allows malicious actors to potentially compromise system integrity and could lead to unauthorized actions on the server.

References