CVE-2021-20136

Name of the Vulnerable Software and Affected Versions: ManageEngine Log360 versions prior to 5235

Description: The issue is related to improper access control, allowing an unauthenticated remote attacker to send a specially crafted message to change the backend database to an attacker-controlled one and force a restart. This can be leveraged for remote code execution by replacing files executed on startup.

Recommendations: For versions prior to 5235, update to version 5235 or later to resolve the issue. As a temporary workaround, consider restricting access to the database configuration to minimize the risk of exploitation.