CVE-2020-21642

CRITICAL 9.8CVE-2020-21642 · Published 15/08/2022 · updated 17/06/2026

In short

CVE-2020-21642 is a CRITICAL (CVSS 9.8) vulnerability affecting manageengine analytics plus (zohocorp).
Chance of exploitation in the next 30 days (EPSS): 7.3%, higher than 94.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
manageengine analytics plus zohocorp	`= 2.9= 3.0= 3.1= 3.2= 3.3= 3.4= 3.5= 3.6= 3.7= 3.8= 3.9= 4.0= 4.1= 4.2= 4.3`	No fix yet

Description

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code.

References

manageengine.com/analytics-plus/release-notes.html · Release Notes

More vulnerabilities in manageengine analytics plus

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

manageengine analytics plus

zohocorp

= 2.9= 3.0= 3.1= 3.2= 3.3= 3.4= 3.5= 3.6= 3.7= 3.8= 3.9= 4.0= 4.1= 4.2= 4.3

No fix yet

More vulnerabilities in manageengine analytics plus

See all →