PT-2021-11414
CVE-2020-27733
·
Published
2021-01-19
·
Updated
2022-10-07
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
Zoho ManageEngine Applications Manager versions prior to 14 build 14880
Description:
The issue allows an authenticated SQL Injection via a crafted Alarmview request. This can potentially be exploited by sending a malicious request to the affected system.
Recommendations:
For versions prior to 14 build 14880, update to a version 14 build 14880 or later to resolve the issue.
As a temporary workaround, consider restricting access to the Alarmview request to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾