medium4.3
CVE-2020-8422
An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450.
Impact
An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup name, and description (but not the password).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Remote Access Plus | before 10.0.450 |
References
- NVD record
- CVE.org record
- https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-8422
- https://excellium-services.com/cert-xlm-advisory/CVE-2020-8422
- https://excellium-services.com/cert-xlm-advisory/cve-2020-8422/
- https://excellium-services.com/cert-xlm-advisory/CVE-2020-8422
- https://excellium-services.com/cert-xlm-advisory/cve-2020-8422/