Read the docs
TI-2020-14120 Aliases CVE-2020-21642GHSA-c2h4-63xc-8qh6

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho…

Priority MEDIUM 52CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code.

Why it matters now

EPSS 0.07333 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 41

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2900:*:*:*:*:*:*2.9 build2900VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2901:*:*:*:*:*:*2.9 build2901VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2902:*:*:*:*:*:*2.9 build2902VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2903:*:*:*:*:*:*2.9 build2903VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2904:*:*:*:*:*:*2.9 build2904VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2905:*:*:*:*:*:*2.9 build2905VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2906:*:*:*:*:*:*2.9 build2906VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2907:*:*:*:*:*:*2.9 build2907VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3000:*:*:*:*:*:*3.0 build3000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3010:*:*:*:*:*:*3.0 build3010VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2900:*:*:*:*:*:* Versions 2.9 build2900 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2901:*:*:*:*:*:* Versions 2.9 build2901 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2902:*:*:*:*:*:* Versions 2.9 build2902 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2903:*:*:*:*:*:* Versions 2.9 build2903 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2904:*:*:*:*:*:* Versions 2.9 build2904 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2905:*:*:*:*:*:* Versions 2.9 build2905 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2906:*:*:*:*:*:* Versions 2.9 build2906 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:2.9:build2907:*:*:*:*:*:* Versions 2.9 build2907 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3000:*:*:*:*:*:* Versions 3.0 build3000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3010:*:*:*:*:*:* Versions 3.0 build3010 Vulnerable ·Zohocorp
Show 31 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3020:*:*:*:*:*:*3.0 build3020VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3030:*:*:*:*:*:*3.0 build3030VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3040:*:*:*:*:*:*3.0 build3040VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3050:*:*:*:*:*:*3.0 build3050VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.1:build3100:*:*:*:*:*:*3.1 build3100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.1:build3110:*:*:*:*:*:*3.1 build3110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.1:build3120:*:*:*:*:*:*3.1 build3120VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.1:build3130:*:*:*:*:*:*3.1 build3130VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.1:build3140:*:*:*:*:*:*3.1 build3140VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.2:build3200:*:*:*:*:*:*3.2 build3200VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.2:build3250:*:*:*:*:*:*3.2 build3250VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.3:build3300:*:*:*:*:*:*3.3 build3300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.3:build3310:*:*:*:*:*:*3.3 build3310VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.4:build3400:*:*:*:*:*:*3.4 build3400VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.4:build3450:*:*:*:*:*:*3.4 build3450VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.5:build3500:*:*:*:*:*:*3.5 build3500VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.6:build3600:*:*:*:*:*:*3.6 build3600VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.7:build3700:*:*:*:*:*:*3.7 build3700VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.8:build3800:*:*:*:*:*:*3.8 build3800VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.9:build3900:*:*:*:*:*:*3.9 build3900VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.9:build3950:*:*:*:*:*:*3.9 build3950VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.0:build4000:*:*:*:*:*:*4.0 build4000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.1:build4100:*:*:*:*:*:*4.1 build4100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.1:build4150:*:*:*:*:*:*4.1 build4150VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.2:build4200:*:*:*:*:*:*4.2 build4200VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.2:build4250:*:*:*:*:*:*4.2 build4250VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.2:build4260:*:*:*:*:*:*4.2 build4260VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.2:build4270:*:*:*:*:*:*4.2 build4270VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.2:build4280:*:*:*:*:*:*4.2 build4280VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.3:build4300:*:*:*:*:*:*4.3 build4300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.3:build4310:*:*:*:*:*:*4.3 build4310VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3020:*:*:*:*:*:* Versions 3.0 build3020 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3030:*:*:*:*:*:* Versions 3.0 build3030 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3040:*:*:*:*:*:* Versions 3.0 build3040 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.0:build3050:*:*:*:*:*:* Versions 3.0 build3050 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.1:build3100:*:*:*:*:*:* Versions 3.1 build3100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.1:build3110:*:*:*:*:*:* Versions 3.1 build3110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.1:build3120:*:*:*:*:*:* Versions 3.1 build3120 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.1:build3130:*:*:*:*:*:* Versions 3.1 build3130 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.1:build3140:*:*:*:*:*:* Versions 3.1 build3140 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.2:build3200:*:*:*:*:*:* Versions 3.2 build3200 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.2:build3250:*:*:*:*:*:* Versions 3.2 build3250 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.3:build3300:*:*:*:*:*:* Versions 3.3 build3300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.3:build3310:*:*:*:*:*:* Versions 3.3 build3310 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.4:build3400:*:*:*:*:*:* Versions 3.4 build3400 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.4:build3450:*:*:*:*:*:* Versions 3.4 build3450 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.5:build3500:*:*:*:*:*:* Versions 3.5 build3500 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.6:build3600:*:*:*:*:*:* Versions 3.6 build3600 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.7:build3700:*:*:*:*:*:* Versions 3.7 build3700 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.8:build3800:*:*:*:*:*:* Versions 3.8 build3800 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.9:build3900:*:*:*:*:*:* Versions 3.9 build3900 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:3.9:build3950:*:*:*:*:*:* Versions 3.9 build3950 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.0:build4000:*:*:*:*:*:* Versions 4.0 build4000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.1:build4100:*:*:*:*:*:* Versions 4.1 build4100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.1:build4150:*:*:*:*:*:* Versions 4.1 build4150 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.2:build4200:*:*:*:*:*:* Versions 4.2 build4200 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.2:build4250:*:*:*:*:*:* Versions 4.2 build4250 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.2:build4260:*:*:*:*:*:* Versions 4.2 build4260 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.2:build4270:*:*:*:*:*:* Versions 4.2 build4270 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.2:build4280:*:*:*:*:*:* Versions 4.2 build4280 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.3:build4300:*:*:*:*:*:* Versions 4.3 build4300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_analytics_plus:4.3:build4310:*:*:*:*:*:* Versions 4.3 build4310 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-21642
  2. 2026-10-03 Alias added: GHSA-c2h4-63xc-8qh6

References

Advisory 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-08640 SQL injection in Zohocorp Analytics Plus CVSS 3.1HIGH 8.8
  • TI-2024-34996 Sensitive data exposure in ManageEngine Analytics Plus CVSS 3.1HIGH 8.1
  • TI-2020-14119 Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics… CVSS 3.1HIGH 7.5
  • TI-2019-09057 Multiple Zoho ManageEngine products suffer from local privilege escalation due to… CVSS 3.0HIGH 7.8
  • TI-2023-05614 ManageEngine Information Disclosure in Multiple Products CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences