CVE-2021-20136: Critical severity Zohocorp Manageengine Log360 vulnerability
ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote attacker can send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and to force Log360 to restart. An attacker can leverage this vulnerability to achieve remote code execution by replacing files executed by Log360 on startup.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-20136?
CVE-2021-20136 is considered a high severity vulnerability due to its potential for unauthorized database configuration changes.
How can I fix CVE-2021-20136?
To fix CVE-2021-20136, update ManageEngine Log360 to version 5.3 build 5235 or later.
What versions of ManageEngine Log360 are affected by CVE-2021-20136?
ManageEngine Log360 builds prior to 5.3 build 5235, including builds 5232, 5233, and 5234, are affected by CVE-2021-20136.
What type of vulnerability is CVE-2021-20136?
CVE-2021-20136 is an improper access control vulnerability that can allow remote attackers to overwrite database configurations.
Who can exploit CVE-2021-20136?
An unauthenticated remote attacker can exploit CVE-2021-20136 to manipulate the database configuration of vulnerable Log360 instances.