PT-2018-5088 · Zoho · Zoho Manageengine Applications Manager

Lukasz Juszczyk · Publicado 2018-07-13 · Atualizado 2019-10-09 · CVE-2016-9498

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 12 through 13 before build 13200

Description The issue allows unserialization of unsafe Java objects, which can be exploited by a remote user without authentication. This enables the execution of remote code, compromising both the application and the operating system. Since the RMI registry of the Application Manager runs with system administrator privileges, exploiting this issue grants an attacker the highest privileges on the underlying operating system.

Recommendations For ManageEngine Applications Manager versions 12 through 13 before build 13200, update to build 13200 or later to resolve the issue.

Correção

RCE

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2016-9498

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 5

• https://securityfocus.com/bid/97394 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9498 · Nota de Segurança
• http://seclists.org/fulldisclosure/2017/Apr/9 · Nota
• https://osv.dev/vulnerability/CVE-2016-9498 · Aviso do Fabricante
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9498.html · Aviso do Fabricante