CVE-2021-20109

Name of the Vulnerable Software and Affected Versions ManageEngine AssetExplorer (affected versions not specified)

Description The issue is related to the Asset Explorer agent not validating HTTPS certificates, allowing an attacker on the network to send a NEWSCAN request to a listening agent and receive the agent's HTTP request verifying its authtoken. In the AEAgent.cpp file, the agent is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using the vswprintf function and written to a buffer that is only 0x2000 bytes big. If the POST payload is larger, a heap overflow will occur.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.