CVE-2020-21642

Published: Aug 15, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code.

Affected (41)

Products: Zohocorp: Manageengine Analytics Plus

Zohocorp

1 product

Manageengine Analytics Plus

Configuration A

41 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Analytics Plus	Version 2.9 build2900
Zohocorp Manageengine Analytics Plus	Version 2.9 build2901
Zohocorp Manageengine Analytics Plus	Version 2.9 build2902
Zohocorp Manageengine Analytics Plus	Version 2.9 build2903
Zohocorp Manageengine Analytics Plus	Version 2.9 build2904
Zohocorp Manageengine Analytics Plus	Version 2.9 build2905
Zohocorp Manageengine Analytics Plus	Version 2.9 build2906
Zohocorp Manageengine Analytics Plus	Version 2.9 build2907
Zohocorp Manageengine Analytics Plus	Version 3.0 build3000
Zohocorp Manageengine Analytics Plus	Version 3.0 build3010
Zohocorp Manageengine Analytics Plus	Version 3.0 build3020
Zohocorp Manageengine Analytics Plus	Version 3.0 build3030
Zohocorp Manageengine Analytics Plus	Version 3.0 build3040
Zohocorp Manageengine Analytics Plus	Version 3.0 build3050
Zohocorp Manageengine Analytics Plus	Version 3.1 build3100
Zohocorp Manageengine Analytics Plus	Version 3.1 build3110
Zohocorp Manageengine Analytics Plus	Version 3.1 build3120
Zohocorp Manageengine Analytics Plus	Version 3.1 build3130
Zohocorp Manageengine Analytics Plus	Version 3.1 build3140
Zohocorp Manageengine Analytics Plus	Version 3.2 build3200
Zohocorp Manageengine Analytics Plus	Version 3.2 build3250
Zohocorp Manageengine Analytics Plus	Version 3.3 build3300
Zohocorp Manageengine Analytics Plus	Version 3.3 build3310
Zohocorp Manageengine Analytics Plus	Version 3.4 build3400
Zohocorp Manageengine Analytics Plus	Version 3.4 build3450
Zohocorp Manageengine Analytics Plus	Version 3.5 build3500
Zohocorp Manageengine Analytics Plus	Version 3.6 build3600
Zohocorp Manageengine Analytics Plus	Version 3.7 build3700
Zohocorp Manageengine Analytics Plus	Version 3.8 build3800
Zohocorp Manageengine Analytics Plus	Version 3.9 build3900
Zohocorp Manageengine Analytics Plus	Version 3.9 build3950
Zohocorp Manageengine Analytics Plus	Version 4.0 build4000
Zohocorp Manageengine Analytics Plus	Version 4.1 build4100
Zohocorp Manageengine Analytics Plus	Version 4.1 build4150
Zohocorp Manageengine Analytics Plus	Version 4.2 build4200
Zohocorp Manageengine Analytics Plus	Version 4.2 build4250
Zohocorp Manageengine Analytics Plus	Version 4.2 build4260
Zohocorp Manageengine Analytics Plus	Version 4.2 build4270
Zohocorp Manageengine Analytics Plus	Version 4.2 build4280
Zohocorp Manageengine Analytics Plus	Version 4.3 build4300
Zohocorp Manageengine Analytics Plus	Version 4.3 build4310

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://www.manageengine.com/analytics-plus/release-notes.html

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.manageengine.com/analytics-plus/release-notes.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.