doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine…
Priority MEDIUM 60CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do.
Why it matters now
EPSS 0.27348 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:* | before 14.9 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:-:*:*:*:*:*:* | 14.9 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14900:*:*:*:*:*:* | 14.9 build14900 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14910:*:*:*:*:*:* | 14.9 build14910 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14911:*:*:*:*:*:* | 14.9 build14911 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14930:*:*:*:*:*:* | 14.9 build14930 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:* Versions before 14.9 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:-:*:*:*:*:*:* Versions 14.9 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14900:*:*:*:*:*:* Versions 14.9 build14900 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14910:*:*:*:*:*:* Versions 14.9 build14910 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14911:*:*:*:*:*:* Versions 14.9 build14911 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_applications_manager:14.9:build14930:*:*:*:*:*:* Versions 14.9 build14930 Vulnerable ·Zohocorp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-35765
- 2026-10-03 Alias added: GHSA-3645-fcrm-r5v6
References
More Zohocorp Manageengine Applications Manager vulnerabilities
- TI-2018-05713 A remote code execution issue was discovered in Zoho ManageEngine Applications Manager… CVSS 3.0CRITICAL 9.8
- TI-2014-06533 The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications… CVSS 3.1HIGH 7.5
- TI-2023-12889 Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager… CVSS 3.1MEDIUM 6.1
- TI-2018-09364 A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x… CVSS 3.0CRITICAL 9.8
- TI-2020-12793 Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated… CVSS 3.1HIGH 8.8
- TI-2020-12540 Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated… CVSS 3.1HIGH 8.8
Sources
- CVE-2020-35765 · CVE Program
- CVE-2020-35765 · NVD
- FIRST EPSS
- GHSA-3645-fcrm-r5v6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences