CVE Vulnerability

CVE-2020-15595

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access.

4 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

4.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:zohocorp:application_control_plus:*:*:*:*:*:*:*:*
Information

Published : 2020-09-30 06:15

Updated : 2021-07-21 11:39

NVD link : CVE-2020-15595

Mitre link : CVE-2020-15595

Products Affected

Application Control Plus

Zohocorp

CWE
NVD-CWE-noinfo