CVE:CVE-2020-24786
CNNVD:CNNVD-202008-1448
在Zoho ManageEngine Exchange Reporter Plus中发现以下问题：内部版本号5510之前，内部版本号4228之前的AD360，内部版本号5817之前的ADSelfService Plus，内部版本号6033之前的DataSecurity Plus，内部版本号6017之前的RecoverManager Plus，内部版本12136之前的EventLog Analyzer，ADAudit内部版本号为6052之前的Plus，内部版本号为4334之前的O365 Manager Plus，内部版本号为4110之前的Cloud Security Plus，内部版本号为7055之前的ADManager Plus和内部版本号为5166之前的Log360。远程访问Java servlet com.manageengine.ads.fw.servlet .UpdateProductDetails容易绕过身份验证。可以修改系统集成属性，并导致完全破坏ManageEngine套件。
solution:Upgrade zohocorp manageengine_adselfservice_plus to a higher version than 5.7,5.8,5.8:5800,5.8:5801,5.8:5802,5.8:5803,5.8:5804,5.8:5805,5.8:5806,5.8:5807,5.8:5808,5.8:5809,5.8:5810,5.8:5811,5.8:5812,5.8:5813,5.8:5814,5.8:5815,5.8:5816,and avoid the version (,5.7],5.8,5.8:5800,5.8:5801,5.8:5802,5.8:5803,5.8:5804,5.8:5805,5.8:5806,5.8:5807,5.8:5808,5.8:5809,5.8:5810,5.8:5811,5.8:5812,5.8:5813,5.8:5814,5.8:5815,5.8:5816; Upgrade zohocorp manageengine_exchange_reporter_plus to a higher version than 5.4,5.5:5500,5.5:5501,5.5:5502,5.5:5503,5.5:5504,and avoid the version (,5.4],5.5:5500,5.5:5501,5.5:5502,5.5:5503,5.5:5504; Upgrade zohocorp manageengine_ad360 to a higher version than 4.1,4.2:4200,4.2:4201,4.2:4202,4.2:4203,4.2:4204,4.2:4205,4.2:4206,4.2:4207,4.2:4208,4.2:4209,4.2:4210,4.2:4212,4.2:4213,4.2:4214,4.2:4215,4.2:4216,4.2:4217,4.2:4219,4.2:4220,4.2:4222,4.2:4223,4.2:4224,4.2:4225,4.2:4227,and avoid the version (,4.1],4.2:4200,4.2:4201,4.2:4202,4.2:4203,4.2:4204,4.2:4205,4.2:4206,4.2:4207,4.2:4208,4.2:4209,4.2:4210,4.2:4212,4.2:4213,4.2:4214,4.2:4215,4.2:4216,4.2:4217,4.2:4219,4.2:4220,4.2:4222,4.2:4223,4.2:4224,4.2:4225,4.2:4227; Upgrade zohocorp manageengine_datasecurity_plus to a higher version than 5.0,6.0:6000,6.0:6001,6.0:6002,6.0:6003,6.0:6010,6.0:6011,6.0:6012,6.0:6013,6.0:6020,6.0:6021,6.0:6030,6.0:6031,6.0:6032,and avoid the version (,5.0],6.0:6000,6.0:6001,6.0:6002,6.0:6003,6.0:6010,6.0:6011,6.0:6012,6.0:6013,6.0:6020,6.0:6021,6.0:6030,6.0:6031,6.0:6032; Upgrade zohocorp manageengine_recovermanager_plus to a higher version than 5.4,6.0:6001,6.0:6003,6.0:6005,6.0:6011,6.0:6016,and avoid the version (,5.4],6.0:6001,6.0:6003,6.0:6005,6.0:6011,6.0:6016; Upgrade zohocorp manageengine_eventlog_analyzer to a higher version than 12.1.2,12.1.3:12130,12.1.3:12135,and avoid the version (,12.1.2],12.1.3:12130,12.1.3:12135; Upgrade zohocorp manageengine_adaudit_plus to a higher version than 5.1,6.0:6000,6.0:6001,6.0:6002,6.0:6003,6.0:6010,6.0:6030,6.0:6031,6.0:6032,6.0:6033,6.0:6050,6.0:6052,and avoid the version (,5.1],6.0:6000,6.0:6001,6.0:6002,6.0:6003,6.0:6010,6.0:6030,6.0:6031,6.0:6032,6.0:6033,6.0:6050,6.0:6052; Upgrade zohocorp manageengine_o365_manager_plus to a higher version than 4.2,4.3:4300,4.3:4301,4.3:4302,4.3:4303,4.3:4304,4.3:4305,4.3:4306,4.3:4308,4.3:4309,4.3:4310,4.3:4311,4.3:4312,4.3:4316,4.3:4317,4.3:4318,4.3:4319,4.3:4320,4.3:4321,4.3:4322,4.3:4324,4.3:4325,4.3:4327,4.3:4328,4.3:4329,4.3:4330,4.3:4331,4.3:4332,4.3:4333,4.3:4334,and avoid the version (,4.2],4.3:4300,4.3:4301,4.3:4302,4.3:4303,4.3:4304,4.3:4305,4.3:4306,4.3:4308,4.3:4309,4.3:4310,4.3:4311,4.3:4312,4.3:4316,4.3:4317,4.3:4318,4.3:4319,4.3:4320,4.3:4321,4.3:4322,4.3:4324,4.3:4325,4.3:4327,4.3:4328,4.3:4329,4.3:4330,4.3:4331,4.3:4332,4.3:4333,4.3:4334; Upgrade zohocorp manageengine_cloud_security_plus to a higher version than 4.0,4.1:4100,4.1:4101,4.1:4102,4.1:4103,4.1:4104,4.1:4105,4.1:4106,4.1:4107,4.1:4108,4.1:4109,and avoid the version (,4.0],4.1:4100,4.1:4101,4.1:4102,4.1:4103,4.1:4104,4.1:4105,4.1:4106,4.1:4107,4.1:4108,4.1:4109; Upgrade zohocorp manageengine_admanager_plus to a higher version than 6.6,7.0:7000,7.0:7010,7.0:7011,7.0:7020,7.0:7030,7.0:7040,7.0:7041,7.0:7050,7.0:7051,7.0:7052,7.0:7053,7.0:7054,and avoid the version (,6.6],7.0:7000,7.0:7010,7.0:7011,7.0:7020,7.0:7030,7.0:7040,7.0:7041,7.0:7050,7.0:7051,7.0:7052,7.0:7053,7.0:7054; Upgrade zohocorp manageengine_log360 to a higher version than 5.0,5.1:5100,5.1:5102,5.1:5107,5.1:5108,5.1:5110,5.1:5111,5.1:5120,5.1:5150,5.1:5154,5.1:5155,5.1:5160,5.1:5164,and avoid the version (,5.0],5.1:5100,5.1:5102,5.1:5107,5.1:5108,5.1:5110,5.1:5111,5.1:5120,5.1:5150,5.1:5154,5.1:5155,5.1:5160,5.1:5164