PT-2017-14595 · Zoho · Zoho Manageengine Applications Manager

Code16 · Publicado 2017-11-16 · Atualizado 2018-08-28 · CVE-2017-16850

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530

Description The issue allows SQL injection via the "showresource.do" endpoint, specifically through the resourceid parameter in a getResourceProfiles action.

Recommendations For Zoho ManageEngine Applications Manager version 13 before build 13530, update to build 13530 or later to resolve the issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-16850

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 4

• http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html · Nota
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16850.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16850 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16850 · Aviso do Fabricante