CVE-2020-13154: 
Zoho ManageEngine ServiceDesk Plus vulnerability analysis and mitigation

Zoho ManageEngine Service Plus before 11.1 build 11112 contains a vulnerability that allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet. The vulnerability was disclosed on May 18, 2020 and is tracked as CVE-2020-13154 (AttackerKB).

The vulnerability exists in the AjaxServlet component of ManageEngine Service Plus and can be exploited by making a getFileProtectionSettings call. The vulnerability has a CVSS v3 Base Score of 6.5 (Medium), with an attack vector requiring network access and low privileges. The attack complexity is rated as low and requires no user interaction (AttackerKB).

The successful exploitation of this vulnerability allows authenticated attackers with low privileges to obtain the File Protection password. This could potentially lead to unauthorized access to protected files within the system (AttackerKB).

The vulnerability requires authentication but can be exploited by users with low privileges. The attack vector is network-based and requires no user interaction, making it relatively straightforward to exploit given the necessary access credentials (AttackerKB).

The vulnerability has been patched in ManageEngine Service Plus version 11.1 build 11112 and later. Organizations should upgrade to the latest version to mitigate this security issue (ManageEngine Readme).