PT-2019-13985 · Zoho · Zoho Manageengine Opmanager

Akkus + 1 · Publicado 2019-08-16 · Atualizado 2019-08-26 · CVE-2019-15104

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.5

Description A SQL Injection issue exists in the jsp/NewThresholdConfiguration.jsp file via the resourceid parameter, allowing a low-authority user to gain SYSTEM authority on the server. This can lead to uploading malicious files using the "Execute Program Action(s)" feature.

Recommendations For Zoho ManageEngine OpManager versions prior to 12.5, as a temporary workaround, consider restricting access to the jsp/NewThresholdConfiguration.jsp file and the "Execute Program Action(s)" feature until a patch is available. Avoid using the resourceid parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-15104

Produtos afetados

Zoho Manageengine Opmanager

Referências · 5

• 🔥 https://exploit-db.com/exploits/47227 · Exploit
• 🔥 http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Privilege-Escalation-Remote-Command-Execution.html · Exploit
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-15104.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-15104 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15104 · Nota de Segurança