CVE-2021-20108
First published: Mon Jul 19 2021(Updated: )
Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp Manageengine Assetexplorer | =1.0.34 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-20108?
CVE-2021-20108 is a vulnerability in Manage Engine Asset Explorer Agent 1.0.34 that allows any user on the network to send commands over port 9000 without authentication.
What is the severity of CVE-2021-20108?
CVE-2021-20108 has a severity rating of 7.5, which is considered high.
How does CVE-2021-20108 affect Manage Engine Asset Explorer Agent?
CVE-2021-20108 affects Manage Engine Asset Explorer Agent 1.0.34 by allowing any user on the network to send commands over port 9000 without authentication.
How can I fix CVE-2021-20108?
To fix CVE-2021-20108, upgrade Manage Engine Asset Explorer Agent to a version that addresses the vulnerability.
Where can I find more information about CVE-2021-20108?
You can find more information about CVE-2021-20108 at the following link: [https://www.tenable.com/security/research/tra-2021-29]
- collector/nvd-index
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/zohocorp
- canonical/zohocorp manageengine assetexplorer
- version/zohocorp manageengine assetexplorer/1.0.34