dbcve.org
Manageengine Adselfservice PlusApplication · Zohocorp

CVE-2020-24786

CRITICAL · 9.8 CVSS v3.1 Published 2020-08-31
Fix available
A fix is available. Upgrade to after 12.1.2 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails in multiple Zoho ManageEngine products allows remote unauthenticated attackers to bypass authentication and modify system integration properties. This can lead to full compromise of the ManageEngine suite.

MitigationApply vendor patches to reach the fixed build numbers for each affected product (5510 for Exchange Reporter Plus, 4228 for AD360, 5817 for ADSelfService Plus, 6033 for DataSecurity Plus, 6017 for RecoverManager Plus, 12136 for EventLog Analyzer, 6052 for ADAudit Plus, 4334 for O365 Manager Plus, 4110 for Cloud Security Plus, 7055 for ADManager Plus, 5166 for Log360). Until patched, restrict network exposure to these applications.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Manageengine Adselfservice PlusApplication
Affected:<= 5.7= 5.8
Manageengine Exchange Reporter PlusApplication
Affected:<= 5.4= 5.5
Manageengine Ad360Application
Affected:<= 4.1= 4.2
Manageengine Datasecurity PlusApplication
Affected:<= 5.0= 6.0
Manageengine Recovermanager PlusApplication
Affected:<= 5.4= 6.0
Manageengine Eventlog AnalyzerApplication
Affected:<= 12.1.2= 12.1.3
Manageengine Adaudit PlusApplication
Affected:<= 5.1= 6.0
Manageengine O365 Manager PlusApplication
Affected:<= 4.2= 4.3

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed ManageEngine product
    Check the product name by accessing the application's login page, checking the title, or inspecting the product-specific service name in Windows Services or Linux init scripts
    Affected if The product is one of: ADSelfService Plus, Exchange Reporter Plus, AD360, DataSecurity Plus, RecoverManager Plus, EventLog Analyzer, ADAudit Plus, or O365 Manager Plus
  2. Determine installed version number
    Access the application's 'About' or 'Help > About' page in the web interface, or check the version.txt/build.info file in the product's installation directory
    Affected if The version falls within or matches any of these vulnerable ranges: <= 5.7 or = 5.8 for ADSelfService Plus; <= 5.4 or = 5.5 for Exchange Reporter Plus; <= 4.1 or = 4.2 for AD360; <= 5.0 or = 6.0 for DataSecurity Plus; <= 5.4 or = 6.0 for RecoverManager Plus; <= 12.1.2 or = 12.1.3 for EventLog Analyz
  3. Verify the vulnerable servlet endpoint exists
    Check if the URL endpoint /servlet/UpdateProductDetails is accessible by attempting to access it directly, or review the web.xml deployment descriptor in the installation directory for the servlet mapping
    Affected if The servlet is present and mapped in the application's configuration, making the authentication bypass vector available
  4. Confirm authentication bypass is exploitable
    Attempt a direct unauthenticated request to the /servlet/UpdateProductDetails endpoint (e.g., via curl or browser). If the application returns system integration property data or allows modification without login, the vulnerability is present
    Affected if The servlet responds without requiring valid authentication credentials, indicating the authentication bypass is active

You are affected if you run any of the listed ManageEngine products and your installed version matches the specified vulnerable ranges and the UpdateProductDetails servlet is accessible without authentication.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 12.1.2
Interim mitigation

Apply vendor patches to reach the fixed build numbers for each affected product (5510 for Exchange Reporter Plus, 4228 for AD360, 5817 for ADSelfService Plus, 6033 for DataSecurity Plus, 6017 for RecoverManager Plus, 12136 for EventLog Analyzer, 6052 for ADAudit Plus, 4334 for O365 Manager Plus, 4110 for Cloud Security Plus, 7055 for ADManager Plus, 5166 for Log360). Until patched, restrict network exposure to these applications.

Recommended fix High confidence

Upgrade to the fixed build numbers: ADSelfService Plus build 5817+, Exchange Reporter Plus build 5510+, AD360 build 4228+, DataSecurity Plus build 6033+, RecoverManager Plus build 6017+, EventLog Analyzer build 12136+, ADAudit Plus build 6052+, O365 Manager Plus build 4334+

  1. Identify the specific ManageEngine product and current build number in your environment
  2. Navigate to the ManageEngine PitStop portal (pitstop.manageengine.com) and locate the security bulletin for this CVE
  3. Download and apply the security patch or upgrade to the fixed build: For ADSelfService Plus upgrade to build 5817 or later; For Exchange Reporter Plus upgrade to build 5510 or later; For AD360 upgrade to build 4228 or later; For DataSecurity Plus upgrade to build 6033 or later; For RecoverManager Plus upgrade to build 6017 or later; For EventLog Analyzer upgrade to build 12136 or later; For ADAudi
  4. After patching, restart the affected service
  5. Verify the servlet UpdateProductDetails is no longer accessible without authentication by reviewing access logs and testing the endpoint
Caveat Standard upgrade considerations apply - review release notes for any configuration or feature changes before upgrading in production

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Manageengine Adselfservice Plus Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing8.0 h
  • Review / QA4.0 h
24.0 hours of engineering $4,160
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,656.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2020-24786 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2020-24786 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data