VulnerabilityModified

CVE-2020-15594

An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511.

MEDIUM 4.3EPSS 1.77%

Does this matter?

Lower severity and a low EPSS score (1.77%). Track it; it rarely justifies an emergency change on its own.

Description

An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attacker to perform a scan in order to discover open ports on a machine as well as available machines on the network segment on which the instance of the product is deployed.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 1.77% probability · 77th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: zohocorp/manageengine application control plus
Source: cve@mitre.org

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-15594
https://excellium-services.com/cert-xlm-advisory/cve-2020-15594/Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/cve-2020-15594/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.