Published: 13/03/2021 Updated: 18/03/2021

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Zoho ManageEngine ServiceDesk Plus prior to 11134 allows an Authentication Bypass (only during SAML login).

Vulnerable Product	Search on Vulmon	Subscribe to Product
zohocorp manageengine servicedesk plus
zohocorp manageengine servicedesk plus 11.1

SD-91948: CVE-2020-35682: Authentication Bypass Vulnerability during SAML login in ServiceDesk Plus.

CVE-2020-35682 SD-91948: CVE-2020-35682: Authentication Bypass Vulnerability during SAML login in ServiceDesk Plus (As described by ManageEngine) If the target ServiceDesk Plus (<11134) installation has SAML login enabled and you have credentials to a low privilege user then you can escalate to administrator and gain RCE I decided to release this POC since there is ne

CWE-863 https://www.manageengine.com/products/service-desk/on-premises/readme.html#11134 https://nvd.nist.gov https://github.com/its-arun/CVE-2020-35682

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2020-35682

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect