Improper Access Control Vulnerability in ManageEngine Log360
CVE-2021-20136

9.8CRITICAL

Key Information:

Vendor

Zohocorp
Status
Manageengine Log360
Vendor
CVE Published:
1 November 2021

What is CVE-2021-20136?

ManageEngine Log360 builds prior to version 5235 are vulnerable to an improper access control issue. This flaw enables an unauthenticated remote attacker to send specifically crafted messages leading to the overwrite of the backend database configuration. Consequently, this may allow the attacker to replace files that Log360 executes upon startup, potentially leading to remote code execution. Organizations utilizing affected versions of Log360 should prioritize updates to mitigate the risk.

Affected Version(s)

ManageEngine Log360 < 5235

References

https://www.tenable.com/security/research/tra-2021-48
x_refsource_MISC

EPSS Score

31% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.