CVE-2020-11531

PoC ×2—

CVSS 3.1

8.8 high

EPSS

14%p96

Published

May 8, 2020 (May 8, 2020)

Modified

Jun 17, 2026

Description

The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot directory via directory traversal.

Vendors: zohocorp
Products: manageengine adaudit plus, manageengine datasecurity plus
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (13.7%)

In the news0 stories

No ingested article mentions this CVE yet.