PT-2019-12996 · Zoho Manageengine · Desktopcentral+2

Publicado 2019-07-17 · Atualizado 2020-08-24 · CVE-2019-12876

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADManager Plus version 6.6.5 Zoho ManageEngine ADSelfService Plus version 5.7 Zoho ManageEngine DesktopCentral version 10.0.380

Description The issue is related to Insecure Permissions, which can lead to Privilege Escalation from low-level privileges to System. This allows an attacker to gain higher privileges than intended.

Recommendations For Zoho ManageEngine ADManager Plus version 6.6.5, update the permissions configuration to ensure proper access control. For Zoho ManageEngine ADSelfService Plus version 5.7, restrict access to sensitive features to prevent exploitation. For Zoho ManageEngine DesktopCentral version 10.0.380, consider disabling any features that rely on the insecure permissions until a proper fix is applied.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2019-12876

Produtos afetados

Admanager Plus

Adselfservice Plus

Desktopcentral

Referências · 4

• 🔥 https://criticalstart.com/2019/07/manageengine-privilege-escalation · Exploit
• http://securityfocus.com/bid/109298 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12876 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12876 · Aviso do Fabricante