Information Disclosure in Zoho Application Control Plus

CVE-2020-15595

What is CVE-2020-15595?

An information disclosure vulnerability exists in Zoho Application Control Plus prior to version 10.0.511. This vulnerability can be exploited through the Element Configuration feature, which is responsible for managing the network elements within the scope of the product. By leveraging this weakness, an attacker can obtain the entire list of configured IP ranges and subnets. Gaining this information enables attackers to create a clearer picture of the internal network topology, potentially exposing sensitive internal resources and creating opportunities for further attacks.

References