CVE-2020-15589 vulnerability in Zoho Corp Products
Published on October 2, 2020
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the client to skip TLS certificate validation, leading to a man-in-the-middle attack against HTTPS and unauthenticated remote code execution.
Products Associated with CVE-2020-15589
stack.watch emails you whenever new vulnerabilities are published in Zoho Corp Manageengine Desktop Central or Zoho Corp Manageengine Remote Access Plus. Just hit a watch button to start following.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.