ManageEngine Log360 and EventLog Analyzer local collector registration bypass
Anyone can secretly register a device with this security log tool.
Summary
A flaw in local collector registration in ManageEngine Log360 and EventLog Analyzer lets an unauthenticated attacker register a collector with a specially crafted request. Versions 13071 and below are affected.
What to do
Check that you run a version newer than 13071 and read the vendor's advisory. The CVE record does not name a fixed version.
Products and platforms
CVE IDs
Times
First published
First seen