The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot directory via directory traversal.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-05-08T20:01:36

Updated: 2024-08-04T11:35:12.684Z

Reserved: 2020-04-04T00:00:00

Link: CVE-2020-11531

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-05-08T21:15:12.400

Modified: 2024-11-21T04:58:05.420

Link: CVE-2020-11531

cve-icon Redhat

No data.