Authentication Bypass in Zohocorp ManageEngine Log360 and EventLog Analyzer

Executive Summary

This vulnerability is an authentication bypass in Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below. It allows an unauthenticated attacker to register a local collector by sending a specially crafted registration request, bypassing normal authentication mechanisms.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unauthorized local collectors have been registered in your EventLog Analyzer or Log360 instances. Review logs for unexpected registration requests or new collector entries. Ensure your software is updated to build 13071 or later.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to impersonate a legitimate local collector, access sensitive configuration data, and inject unauthorized syslog sources. This could lead to fabricated log data being introduced into the system, potentially hiding malicious activity or creating false evidence.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could compromise the integrity of log data, which is critical for compliance audits. Unauthorized log manipulation may violate data integrity requirements in GDPR and HIPAA, potentially leading to non-compliance penalties and loss of trust in audit trails.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update EventLog Analyzer and Log360 to build 13071 or later. If updating is not possible, restrict network access to the registration endpoint and monitor for suspicious activity. Remove any unauthorized collectors.

Useful 0 Not Useful 0