CVEvulnerability

CVE-2020-28679

8.8 HIGH Published 2022-01-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-01-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-89

Description

A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request.

Affected configurations

• zohocorp manageengine applications manager 11.0 • zohocorp manageengine applications manager 11.1 • zohocorp manageengine applications manager 11.2 • zohocorp manageengine applications manager 11.3 • zohocorp manageengine applications manager 11.4 • zohocorp manageengine applications manager 11.5 • zohocorp manageengine applications manager 11.6 • zohocorp manageengine applications manager 11.7 • zohocorp manageengine applications manager 11.8 • zohocorp manageengine applications manager 11.9 • zohocorp manageengine applications manager 12.0 • zohocorp manageengine applications manager 12.1 • zohocorp manageengine applications manager 12.2 • zohocorp manageengine applications manager 12.3 • zohocorp manageengine applications manager 12.5 • zohocorp manageengine applications manager 12.6 • zohocorp manageengine applications manager 12.7 • zohocorp manageengine applications manager 12.8 • zohocorp manageengine applications manager 12.9 • zohocorp manageengine applications manager 13.0 • zohocorp manageengine applications manager 13.1 • zohocorp manageengine applications manager 13.2 • zohocorp manageengine applications manager 13.3 • zohocorp manageengine applications manager 13.4 • zohocorp manageengine applications manager 13.5 • zohocorp manageengine applications manager 13.6 • zohocorp manageengine applications manager 13.7 • zohocorp manageengine applications manager 13.8 • zohocorp manageengine applications manager 13.9 • zohocorp manageengine applications manager 14.0 • zohocorp manageengine applications manager 14.1 • zohocorp manageengine applications manager 14.2 • zohocorp manageengine applications manager 14.3 • zohocorp manageengine applications manager 14.4 • zohocorp manageengine applications manager 14.5

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References