Vulnerability · Published Nov 1, 2021 · Assigned by tenable
CVE-2021-20136
Critical 9.8
In plain English
A critical-severity security flaw in ManageEngine Log360. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.8% (higher than 96% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)10.8%top 4.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote attacker can send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and to force Log360 to restart. An attacker can leverage this vulnerability to achieve remote code execution by replacing files executed by Log360 on startup.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | ManageEngine Log360 | < 5235 |
References
- https://www.tenable.com/security/research/tra-2021-48 x_refsource_MISC