CVE-2020-11946: High severity manageengine opmanager msp vulnerability
Published Apr 20, 2020
·Updated
Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.
Affected Software
14 affected components
ZohoCorp ManageEngine OpManager=12.5-build125000
ZohoCorp ManageEngine OpManager=12.5-build125002
ZohoCorp ManageEngine OpManager=12.5-build125100
ZohoCorp ManageEngine OpManager=12.5-build125101
ZohoCorp ManageEngine OpManager=12.5-build125102
ZohoCorp ManageEngine OpManager=12.5-build125108
ZohoCorp ManageEngine OpManager=12.5-build125110
ZohoCorp ManageEngine OpManager=12.5-build125111
ZohoCorp ManageEngine OpManager=12.5-build125112
ZohoCorp ManageEngine OpManager=12.5-build125113
ZohoCorp ManageEngine OpManager=12.5-build125114
ZohoCorp ManageEngine OpManager=12.5-build125116
ZohoCorp ManageEngine OpManager=12.5-build125117
ZohoCorp ManageEngine OpManager=12.5-build125118
Event History
Apr 20, 2020
CVE Published
via MITRE·08:18 PM
Data Sourced
via MITRE·08:18 PM
Description
Frequently Asked Questions
1
What is CVE-2020-11946?
CVE-2020-11946 is a vulnerability in Zoho ManageEngine OpManager before 125120 that allows an unauthenticated user to retrieve an API key via a servlet call.
2
What is the severity of CVE-2020-11946?
The severity of CVE-2020-11946 is high with a CVSS score of 7.5.
3
How does CVE-2020-11946 affect Zoho ManageEngine OpManager?
CVE-2020-11946 affects Zoho ManageEngine OpManager versions 12.5-build125000 to 12.5-build125118.
4
How can an unauthenticated user retrieve an API key in Zoho ManageEngine OpManager?
An unauthenticated user can retrieve an API key in Zoho ManageEngine OpManager by making a servlet call.
5
How can I fix CVE-2020-11946 in Zoho ManageEngine OpManager?
To fix CVE-2020-11946 in Zoho ManageEngine OpManager, update to version 12.5-build125120 or later.