CVE-2020-11531

The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a…

published May 8, 2020

CVSS
—
EPSS
14%
Percentile
96.5
In the wild
Unconfirmed
What it is

The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot directory via directory traversal.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.13655 · 96.5th percentile
Published
2020-05-08T20:01Z
EPSS history
Timeline
  • 08 MAY 20:01Z
    The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a…
    cvelistv5