CVE-2020-13154: Medium severity zohocorp manageengine servicedesk plus vulnerability
Published May 18, 2020
·Updated
Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet.
Affected Software
13 affected components
ZohoCorp ManageEngine ServiceDesk Plus=11.1
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11100
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11101
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11102
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11103
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11104
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11105
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11106
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11107
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11108
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11109
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11110
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11111
Event History
May 18, 2020
CVE Published
via MITRE·09:38 PM
Data Sourced
via MITRE·09:38 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2020-13154.
2
What is the severity of CVE-2020-13154?
The severity of CVE-2020-13154 is medium, with a severity value of 6.5.
3
How does CVE-2020-13154 affect Zoho ManageEngine Service Plus?
CVE-2020-13154 allows low-privilege authenticated users of Zoho ManageEngine Service Plus to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet.
4
Which versions of Zoho ManageEngine Service Plus are affected by CVE-2020-13154?
Zoho ManageEngine Service Plus versions 11.1 to 11.1 build 11111 are affected by CVE-2020-13154.
5
How can I fix CVE-2020-13154?
To fix CVE-2020-13154, update Zoho ManageEngine Service Plus to version 11.1 build 11112 or later.