PT-2018-10830 · Zoho · Zoho Manageengine Applications Manager

Publicado 2018-06-06 · Atualizado 2018-08-07 · CVE-2018-11808

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to 13 build 13740

Description The issue allows an attacker to delete any file and read certain files on the server by sending a specially crafted request. This occurs in the context of the user, which by default is "NT AUTHORITY / SYSTEM".

Recommendations For versions prior to 13 build 13740, update to build 13740 or later to resolve the issue. As a temporary workaround, consider restricting access to the CustomFieldsFeedServlet to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-11808

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-11808 · Aviso do Fabricante
• https://manageengine.com/products/applications_manager/issues.html · Aviso do Fabricante
• https://github.com/kactrosN/publicdisclosures · Nota
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-11808.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-11808 · Nota de Segurança
• http://securityfocus.com/bid/104467 · Nota