PT-2018-5081 · Manageengine · Zoho Manageengine Applications Manager

Lukasz Juszczyk · Publicado 2018-07-13 · Atualizado 2019-10-09 · CVE-2016-9491

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 12 through 13 before build 13690

Description The issue allows an authenticated user, likely with administrative privileges, to browse the filesystem and read system files, including configuration and stored private keys, by accessing the "/register.do" page. This is possible because the Application Manager runs with administrative privileges by default, granting access to every directory on the underlying operating system.

Recommendations For ManageEngine Applications Manager versions 12 through 13 before build 13690, update to build 13690 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/register.do" page to minimize the risk of exploitation.

Correção

XXE

Information Disclosure

Enumeração de Fraquezas

CWE-611

CWE-200

Identificadores relacionados

CVE-2016-9491

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-9491 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9491 · Aviso do Fabricante
• https://securityfocus.com/bid/97394 · Nota
• http://seclists.org/fulldisclosure/2017/Apr/9 · Nota
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9491.html · Aviso do Fabricante