PT-2018-5079 · Zoho · Zoho Manageengine Applications Manager

Lukasz Juszczyk · Publicado 2018-07-13 · Atualizado 2019-10-09 · CVE-2016-9489

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 12 through 13 before build 13200

Description The issue allows an authenticated user to modify their own properties, including their group membership, potentially escalating their privileges to a higher level, such as "ADMIN". Additionally, a user can alter properties of another user, including changing their password.

Recommendations For ManageEngine Applications Manager versions 12 through 13 before build 13200, update to build 13200 or later to resolve the issue.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-255

CWE-264

CWE-269

Identificadores relacionados

CVE-2016-9489

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 5

• https://securityfocus.com/bid/97394 · Nota
• https://osv.dev/vulnerability/CVE-2016-9489 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2017/Apr/9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9489 · Nota de Segurança
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9489.html · Aviso do Fabricante