CVE-2020-24743 : Security Advisory and Response

An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allowing attackers to gain escalated privileges via the resourceid parameter.

Understanding CVE-2020-24743

This CVE describes a vulnerability in Zoho ManageEngine Applications Manager that could lead to privilege escalation.

What is CVE-2020-24743?

The vulnerability in Zoho ManageEngine Applications Manager up to version 14550 enables attackers to elevate their privileges by exploiting the resourceid parameter.

The Impact of CVE-2020-24743

This vulnerability could be exploited by malicious actors to gain escalated privileges within the affected system, potentially leading to unauthorized access and control.

Technical Details of CVE-2020-24743

This section provides more technical insights into the vulnerability.

Vulnerability Description

The issue lies in the /showReports.do endpoint of Zoho ManageEngine Applications Manager, allowing attackers to manipulate the resourceid parameter for privilege escalation.

Affected Systems and Versions

Product: Zoho ManageEngine Applications Manager
Versions affected: Up to version 14550

Exploitation Mechanism

Attackers can exploit the vulnerability by sending crafted requests to the /showReports.do endpoint with a manipulated resourceid parameter to gain elevated privileges.

Mitigation and Prevention

Protecting systems from CVE-2020-24743 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply security patches provided by Zoho ManageEngine promptly.
Monitor system logs for any suspicious activities related to the resourceid parameter.

Long-Term Security Practices

Regularly update and patch software to prevent known vulnerabilities.
Implement least privilege access controls to limit the impact of potential privilege escalation attacks.
Conduct regular security assessments and penetration testing to identify and address security weaknesses.
Educate users and administrators about safe practices to mitigate the risk of exploitation.
Consider implementing additional security measures such as web application firewalls.

Patching and Updates

Ensure that the Zoho ManageEngine Applications Manager is updated to a version that includes a fix for CVE-2020-24743 to mitigate the risk of privilege escalation.