CVE-2020-11532

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine DataSecurity Plus versions prior to 6.0.1

Description The issue allows an attacker to bypass authentication for the DataEngine Xnode server and execute all operations in the context of the admin user, due to the use of default admin credentials for communication with the server.

Recommendations For versions prior to 6.0.1, update to version 6.0.1 or later to resolve the issue. As a temporary workaround, consider changing the default admin credentials used by Zoho ManageEngine DataSecurity Plus to communicate with the DataEngine Xnode server. Restrict access to the DataEngine Xnode server to minimize the risk of exploitation.