CVE-2020-21641: XEE
Published Aug 15, 2022
·Updated
Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file.
Affected Software
1 affected component
ZohoCorp ManageEngine Analytics Plus<4.3.5
Event History
Aug 15, 2022
CVE Published
via MITRE·07:10 PM
Data Sourced
via MITRE·07:10 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-21641.
2
What is the severity level of CVE-2020-21641?
CVE-2020-21641 has a severity level of high.
3
Which software is affected by CVE-2020-21641?
Zoho ManageEngine Analytics Plus versions up to but not including 4.3.5 are affected by CVE-2020-21641.
4
What does CVE-2020-21641 allow attackers to do?
CVE-2020-21641 allows remote attackers to read arbitrary files, enumerate folders, and scan internal ports via a crafted XML license file.
5
How can I fix CVE-2020-21641?
To fix CVE-2020-21641, you should update Zoho ManageEngine Analytics Plus to version 4.3.5 or higher.