SSRF in Zohocorp Manageengine Remote Access Plus
CVE-2019-20474
An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role (read-only access) to use and abuse it. One of the abuses allows performing network and port scan operations of the localhost or the hosts on the same network segment, aka SSRF.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.014 (72.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 72.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
- Zohocorp Manageengine Remote Access Plus — versions 10.0.447
Weakness classification (CWE)
References
- www.manageengine.com/remote-desktop-management/knowledge-base/authorization-fai… (Vendor Advisory)
- excellium-services.com/cert-xlm-advisory/cve-2019-20474/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2019-20474?
- CVE-2019-20474 is a medium-severity vulnerability in Zohocorp Manageengine Remote Access Plus, classified under Server-Side Request Forgery (SSRF). CVSS score: 4.3/10. Published 2020-02-17.
- How severe is CVE-2019-20474?
- Medium severity. CVSS v3 base score is 4.3 out of 10.