CVE-2020-27995

Published: Oct 29, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid parameter.

Affected (68)

Products: Zohocorp: Manageengine Applications Manager

Zohocorp

1 product

Manageengine Applications Manager

Configuration A

68 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Applications Manager	Version 14.0
Zohocorp Manageengine Applications Manager	Version 14.0 build14000
Zohocorp Manageengine Applications Manager	Version 14.0 build14010
Zohocorp Manageengine Applications Manager	Version 14.0 build14020
Zohocorp Manageengine Applications Manager	Version 14.0 build14030
Zohocorp Manageengine Applications Manager	Version 14.0 build14040
Zohocorp Manageengine Applications Manager	Version 14.0 build14050
Zohocorp Manageengine Applications Manager	Version 14.0 build14060
Zohocorp Manageengine Applications Manager	Version 14.0 build14070
Zohocorp Manageengine Applications Manager	Version 14.0 build14071
Zohocorp Manageengine Applications Manager	Version 14.0 build14072
Zohocorp Manageengine Applications Manager	Version 14.0 build14073
Zohocorp Manageengine Applications Manager	Version 14.0 build14080
Zohocorp Manageengine Applications Manager	Version 14.0 build14090
Zohocorp Manageengine Applications Manager	Version 14.0 build14100
Zohocorp Manageengine Applications Manager	Version 14.0 build14110
Zohocorp Manageengine Applications Manager	Version 14.0 build14120
Zohocorp Manageengine Applications Manager	Version 14.0 build14130
Zohocorp Manageengine Applications Manager	Version 14.0 build14140
Zohocorp Manageengine Applications Manager	Version 14.0 build14150
Zohocorp Manageengine Applications Manager	Version 14.0 build14160
Zohocorp Manageengine Applications Manager	Version 14.0 build14170
Zohocorp Manageengine Applications Manager	Version 14.0 build14180
Zohocorp Manageengine Applications Manager	Version 14.0 build14190
Zohocorp Manageengine Applications Manager	Version 14.0 build14200
Zohocorp Manageengine Applications Manager	Version 14.0 build14210
Zohocorp Manageengine Applications Manager	Version 14.0 build14220
Zohocorp Manageengine Applications Manager	Version 14.0 build14230
Zohocorp Manageengine Applications Manager	Version 14.0 build14240
Zohocorp Manageengine Applications Manager	Version 14.0 build14250
Zohocorp Manageengine Applications Manager	Version 14.0 build14260
Zohocorp Manageengine Applications Manager	Version 14.0 build14261
Zohocorp Manageengine Applications Manager	Version 14.0 build14262
Zohocorp Manageengine Applications Manager	Version 14.0 build14270
Zohocorp Manageengine Applications Manager	Version 14.0 build14280
Zohocorp Manageengine Applications Manager	Version 14.0 build14290
Zohocorp Manageengine Applications Manager	Version 14.0 build14300
Zohocorp Manageengine Applications Manager	Version 14.0 build14310
Zohocorp Manageengine Applications Manager	Version 14.0 build14330
Zohocorp Manageengine Applications Manager	Version 14.0 build14331
Zohocorp Manageengine Applications Manager	Version 14.0 build14332
Zohocorp Manageengine Applications Manager	Version 14.0 build14340
Zohocorp Manageengine Applications Manager	Version 14.0 build14350
Zohocorp Manageengine Applications Manager	Version 14.0 build14360
Zohocorp Manageengine Applications Manager	Version 14.0 build14361
Zohocorp Manageengine Applications Manager	Version 14.0 build14370
Zohocorp Manageengine Applications Manager	Version 14.0 build14380
Zohocorp Manageengine Applications Manager	Version 14.0 build14390
Zohocorp Manageengine Applications Manager	Version 14.0 build14400
Zohocorp Manageengine Applications Manager	Version 14.0 build14401
Zohocorp Manageengine Applications Manager	Version 14.0 build14410
Zohocorp Manageengine Applications Manager	Version 14.0 build14420
Zohocorp Manageengine Applications Manager	Version 14.0 build14430
Zohocorp Manageengine Applications Manager	Version 14.0 build14440
Zohocorp Manageengine Applications Manager	Version 14.0 build14450
Zohocorp Manageengine Applications Manager	Version 14.0 build14460
Zohocorp Manageengine Applications Manager	Version 14.0 build14470
Zohocorp Manageengine Applications Manager	Version 14.0 build14480
Zohocorp Manageengine Applications Manager	Version 14.0 build14490
Zohocorp Manageengine Applications Manager	Version 14.0 build14500
Zohocorp Manageengine Applications Manager	Version 14.0 build14510
Zohocorp Manageengine Applications Manager	Version 14.0 build14520
Zohocorp Manageengine Applications Manager	Version 14.0 build14530
Zohocorp Manageengine Applications Manager	Version 14.0 build14531
Zohocorp Manageengine Applications Manager	Version 14.0 build14532
Zohocorp Manageengine Applications Manager	Version 14.0 build14533
Zohocorp Manageengine Applications Manager	Version 14.0 build14540
Zohocorp Manageengine Applications Manager	Version 14.0 build14550

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (2)

https://www.manageengine.com/products/applications_manager/issues.html#v14560

Source: cve@mitre.org

Vendor Advisory

https://www.manageengine.com/products/applications_manager/issues.html#v14560

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.