CVE-2021-42956 Information
Jun 07, 2022
cve
Description
Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management the process launches as the logged in user so memory dump can be done by non-admin also. Remotely an attacker can dump all sensitive information including DB Connection string entire IT infrastructure details commands executed by IT admin including credentials secrets private keys and more.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Reference
Attack Complexity
LOW
Privileges Required
LOW
User Interaction Required
LOW
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
HIGH
Base Severity
8.8
Share on: