CVE-2020-27733

💻 Affected Systems

📦 What is this software?

⚠️ Risk & Real-World Impact

🎯 Exploit Status

SQL injection vulnerabilities are commonly exploited and weaponized. While no public PoC is confirmed, the vulnerability type suggests exploitation is straightforward for attackers with valid credentials.

🔍 How to Verify

Check the Applications Manager version in the web interface under Help > About or examine the installation directory for version files.

Check the web interface or examine the <install_dir>/conf/version.txt file

Verify the version is 14 build 14880 or later and test that Alarmview functionality works without SQL injection vulnerabilities.

📡 Detection & Monitoring

source="applications_manager" AND (event="SQL_ERROR" OR request_uri="*alarmview*" AND (sql="*SELECT*" OR sql="*UNION*"))

🔗 References

• https://www.manageengine.com/products/applications_manager/issues.html#v14880 Issue Tracking,Release Notes,Vendor Advisory
• https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-27733.html Release Notes,Vendor Advisory
• https://www.manageengine.com/products/applications_manager/issues.html#v14880 Issue Tracking,Release Notes,Vendor Advisory
• https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-27733.html Release Notes,Vendor Advisory