CVE-2020-35682: 
Zoho ManageEngine ServiceDesk Plus vulnerability analysis and mitigation

CVE-2020-35682 affects Zoho ManageEngine ServiceDesk Plus before version 11134, allowing an Authentication Bypass vulnerability specifically during SAML login. The vulnerability was disclosed on March 13, 2021 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs low privileges, requires no user interaction, and has high impacts on confidentiality, integrity, and availability (NVD).

The vulnerability allows attackers to bypass authentication mechanisms during SAML login, potentially leading to unauthorized access to the system. Given the CVSS score of 8.8, this vulnerability can result in a complete compromise of system confidentiality, integrity, and availability (NVD).

The vulnerability requires low attack complexity and low privileges to exploit, making it relatively accessible to attackers. The attack vector is network-based, meaning it can be exploited remotely. No user interaction is required for exploitation (NVD).

The vulnerability has been fixed in Zoho ManageEngine ServiceDesk Plus version 11134. Organizations using affected versions should upgrade to version 11134 or later to mitigate this security risk (Vendor Advisory).