{"id":"CVE-2020-14008","aliases":["EUVD-2020-6175","GHSA-5f59-43c8-2pqw"],"status":"published","title":"Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to...","description":"Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.3957,"percentile":0.98627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2020-09-04T14:14:15Z","modified":"2026-06-17T02:54:05Z","exploits":[{"source":"exploitdb","id":"EDB-48793","title":"ManageEngine Applications Manager 14700 - Remote Code Execution (Authenticated)","type":"webapps","platform":"java","date":"2020-09-07","url":"https://www.exploit-db.com/exploits/48793"},{"source":"pocgithub","id":"JackHars/cve-2020-14008","title":"JackHars/cve-2020-14008","date":"2025-05-26","url":"https://github.com/JackHars/cve-2020-14008"},{"source":"pocgithub","id":"0x0d3ad/CVE-2020-14008","title":"0x0d3ad/CVE-2020-14008","date":"2026-05-09","url":"https://github.com/0x0d3ad/CVE-2020-14008"},{"source":"pocgithub","id":"raflesiait/CVE-2020-14008_ManageEngine","title":"raflesiait/CVE-2020-14008_ManageEngine","date":"2026-09-27","url":"https://github.com/raflesiait/CVE-2020-14008_ManageEngine"}],"products":[{"vendor":"zohocorp","product":"manageengine_applications_manager"}],"references":[{"url":"https://www.manageengine.com","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory"]},{"url":"https://www.manageengine.com/products/applications_manager/issues.html#14730","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/159066/ManageEngine-Applications-Manager-Authenticated-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14008"},{"url":"https://github.com/advisories/GHSA-5f59-43c8-2pqw"}],"sources":{"cve":[{"id":"CVE-2020-14008","description":"Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.","status":"published","published":"2020-09-04T14:14:15Z","modified":"2024-08-04T12:32:14.657Z","updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6175","description":"Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.","status":"published","published":"2020-09-04T14:14:15Z","modified":"2024-08-04T12:32:14Z","updated_at":"2026-11-03T03:07:35.697348Z"}],"ghsa":[{"id":"GHSA-5f59-43c8-2pqw","title":"Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to...","description":"Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.","status":"published","published":"2022-05-24T17:27:24Z","modified":"2023-01-29T05:03:57Z","updated_at":"2026-11-02T14:45:26.08688Z"}],"nvd":[{"id":"CVE-2020-14008","description":"Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.","status":"published","published":"2020-09-04T15:15:10.63Z","modified":"2026-06-17T02:54:05.69Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:06:14.981587Z"}]}}