CVE-2021-20136

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote attacker can send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and to force Log360 to restart. An attacker can leverage this vulnerability to achieve remote code execution by replacing files executed by Log360 on startup.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Nov 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-201376.1A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower routeCVE-2021-201388.8An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/lucCVE-2021-201398.8An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon TowerCVE-2021-20144.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that are affected are 5.7CVE-2021-201408.8An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon ToweCVE-2021-201418.8An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon ToweCVE-2021-201428.8An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon ToweCVE-2021-201438.8An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon ToweCVE-2021-201448.8An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server service on Gryphon ToweCVE-2021-201457.5Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN networCVE-2021-201469.8An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon'CVE-2021-201475.3ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI.