CVEs-PoC/2020/CVE-2020-11532.md

CVE-2020-11532

Description

Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user.

POC

Reference

• http://packetstormsecurity.com/files/157609/ManageEngine-DataSecurity-Plus-Authentication-Bypass.html
• http://seclists.org/fulldisclosure/2020/May/28

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/ARPSyndicate/cvemon
• https://github.com/cyb3r-w0lf/nuclei-template-collection