What is CVE-2019-20474?

CVE-2019-20474 is a medium-severity vulnerability in Zohocorp Manageengine Remote Access Plus, classified under Server-Side Request Forgery (SSRF). CVSS score: 4.3/10. Published 2020-02-17.

How severe is CVE-2019-20474?

Medium severity. CVSS v3 base score is 4.3 out of 10.

SSRF in Zohocorp Manageengine Remote Access Plus

CVE-2019-20474

An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role (read-only access) to use and abuse it. One of the abuses allows performing network and port scan operations of the localhost or the hosts on the same network segment, aka SSRF.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.014 (70.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Zohocorp Manageengine_remote_access_plus — versions 10.0.447
N/a — versions n/a

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-20474?: CVE-2019-20474 is a medium-severity vulnerability in Zohocorp Manageengine Remote Access Plus, classified under Server-Side Request Forgery (SSRF). CVSS score: 4.3/10. Published 2020-02-17.
How severe is CVE-2019-20474?: Medium severity. CVSS v3 base score is 4.3 out of 10.