Read the docs
TI-2020-12230 Aliases CVE-2020-15533GHSA-4w4c-gwj8-5ff9

In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between…

Priority MEDIUM 49CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack.

Why it matters now

EPSS 0.04203 91st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*before 14.6VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:-:*:*:*:*:*:*14.6VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:build14680:*:*:*:*:*:*14.6 build14680VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:build14681:*:*:*:*:*:*14.6 build14681VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:build14682:*:*:*:*:*:*14.6 build14682VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:build14683:*:*:*:*:*:*14.6 build14683VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:build14690:*:*:*:*:*:*14.6 build14690VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:-:*:*:*:*:*:*14.7VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:build14700:*:*:*:*:*:*14.7 build14700VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:build14710:*:*:*:*:*:*14.7 build14710VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:* Versions before 14.6 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:-:*:*:*:*:*:* Versions 14.6 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:build14680:*:*:*:*:*:* Versions 14.6 build14680 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:build14681:*:*:*:*:*:* Versions 14.6 build14681 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:build14682:*:*:*:*:*:* Versions 14.6 build14682 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:build14683:*:*:*:*:*:* Versions 14.6 build14683 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.6:build14690:*:*:*:*:*:* Versions 14.6 build14690 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:-:*:*:*:*:*:* Versions 14.7 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:build14700:*:*:*:*:*:* Versions 14.7 build14700 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:build14710:*:*:*:*:*:* Versions 14.7 build14710 Vulnerable ·Zohocorp
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:build14720:*:*:*:*:*:*14.7 build14720VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:build14730:*:*:*:*:*:*14.7 build14730VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:build14740:*:*:*:*:*:*14.7 build14740VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:build14720:*:*:*:*:*:* Versions 14.7 build14720 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:build14730:*:*:*:*:*:* Versions 14.7 build14730 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_applications_manager:14.7:build14740:*:*:*:*:*:* Versions 14.7 build14740 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15533
  2. 2026-10-03 Alias added: GHSA-4w4c-gwj8-5ff9

References

Advisory 3

  • TI-2018-05713 A remote code execution issue was discovered in Zoho ManageEngine Applications Manager… CVSS 3.0CRITICAL 9.8
  • TI-2014-06533 The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications… CVSS 3.1HIGH 7.5
  • TI-2023-12889 Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager… CVSS 3.1MEDIUM 6.1
  • TI-2018-09364 A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x… CVSS 3.0CRITICAL 9.8
  • TI-2020-12793 Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated… CVSS 3.1HIGH 8.8
  • TI-2020-12540 Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated… CVSS 3.1HIGH 8.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences