CVE-2020-15595

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595	Exploit Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zohocorp:application_control_plus:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:05

Type	Values Removed	Values Added
References	~~() https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595 - Exploit, Third Party Advisory~~	() https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595 - Exploit, Third Party Advisory

Information

Published : 2020-09-30 18:15

Updated : 2024-11-21 05:05

NVD link : CVE-2020-15595

Mitre link : CVE-2020-15595

CVE.ORG link : CVE-2020-15595

JSON object : View

Products Affected

zohocorp

application_control_plus

CWE

NVD-CWE-noinfo

{"id": "CVE-2020-15595", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2020-09-30T18:15:22.413", "references": [{"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Zoho Application Control Plus versiones anteriores a 10.0.511. La funcionalidad Element Configuration (para configurar elementos incluidos en el alcance de los elementos gestionados por el producto) permite a un atacante recuperar la lista completa de los rangos de IP y subredes configuradas en el producto y, en consecuencia, obtener informaci\u00f3n sobre la cartograf\u00eda de las redes internas a las que el producto presenta acceso"}], "lastModified": "2024-11-21T05:05:49.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:application_control_plus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8138BB72-FFBA-41ED-872B-45F12C1F7E80", "versionEndExcluding": "10.0.511"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}