CVE-2021-20109
First published: Mon Jul 19 2021(Updated: )
Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using vswprintf. This is written to a buffer only 0x2000 bytes big. If POST payload is larger, then heap overflow will occur.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp Manageengine Assetexplorer | =1.0.34 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-20109?
CVE-2021-20109 is a vulnerability in Zohocorp Manageengine Assetexplorer where the Asset Explorer agent does not validate HTTPS certificates, potentially allowing an attacker to send malicious requests.
What is the severity of CVE-2021-20109?
CVE-2021-20109 has a severity rating of 7.5 (High).
How does CVE-2021-20109 impact Zohocorp Manageengine Assetexplorer?
CVE-2021-20109 allows an attacker on the network to configure their IP address to match the Asset Explorer's server IP address and send malicious requests.
How can I fix CVE-2021-20109?
To fix CVE-2021-20109, it is recommended to update to a version of Zohocorp Manageengine Assetexplorer that includes the fix for this vulnerability.
Is there any additional information about CVE-2021-20109?
Yes, you can find more information about CVE-2021-20109 at the following reference: [Tenable Advisory](https://www.tenable.com/security/research/tra-2021-30).
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/description
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- agent/last-modified-date
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/zohocorp
- canonical/zohocorp manageengine assetexplorer
- version/zohocorp manageengine assetexplorer/1.0.34