CVE-2020-29658
CRITICALCVSS 9.8/10EPSS 3.70%
Last modified
CVE-2020-29658 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation.. EPSS estimates a 3.70% chance of exploitation in the next 30 days.
Description
Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | Manageengine Applications Control Plus | < 100523 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-29658?
Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation.
How severe is CVE-2020-29658?
CVE-2020-29658 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 3.70% probability of exploitation in the next 30 days.
How do I fix CVE-2020-29658?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-29652A nil pointer dereference in the golang.org/x/crypto/ssh com…7.5
- CVE-2020-29653Froxlor through 0.10.22 does not perform validation on user …6.1
- CVE-2020-29654Western Digital Dashboard before 3.2.2.9 allows DLL Hijackin…7.8
- CVE-2020-29655An injection vulnerability exists in RT-AC88U Download Maste…7.5
- CVE-2020-29656An information disclosure vulnerability exists in RT-AC88U D…7.5
- CVE-2020-29657In JerryScript 2.3.0, there is an out-of-bounds read in main…9.1
- CVE-2020-29659A buffer overflow in the web server of Flexense DupScout Ent…9.8
- CVE-2020-2966Vulnerability in the Oracle WebLogic Server product of Oracl…5.4
- CVE-2020-29660A locking inconsistency issue was discovered in the tty subs…4.4
- CVE-2020-29661A locking issue was discovered in the tty subsystem of the L…7.8
- CVE-2020-29662In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalo…5.3
- CVE-2020-29663Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue whe…9.1
Are you affected by CVE-2020-29658?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST