Vulnerability in Zohocorp Manageengine Assetexplorer
CVE-2021-20108
Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.045 (91.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.045 · newest: 0.045 · change: 0.000
Affected products
- Zohocorp Manageengine Assetexplorer — versions 1.0.34
- Manage Engine Asset Explorer Agent — versions 1.0.34
Weakness classification (CWE)
References
- www.tenable.com/security/research/tra-2021-29 (Third Party Advisory)
Frequently asked questions
- What is CVE-2021-20108?
- CVE-2021-20108 is a high-severity vulnerability in Zohocorp Manageengine Assetexplorer, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 7.5/10. Published 2021-07-19.
- How severe is CVE-2021-20108?
- High severity. CVSS v3 base score is 7.5 out of 10.