PT-2019-7902 · Zoho · Zoho Manageengine Applications Manager

Publicado 2019-05-23 · Atualizado 2019-05-23 · CVE-2017-11740

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager version 13.1 Build 13100

Description The issue allows an administrative user to upload files or binaries that can be executed when an alarm occurs. An attacker can exploit this functionality by uploading a malicious script, which can then be executed on the remote system.

Recommendations For Zoho ManageEngine Application Manager version 13.1 Build 13100, consider restricting the upload functionality for administrative users to prevent the execution of malicious scripts until a fix is available. As a temporary workaround, limit the types of files that can be uploaded to prevent executable binaries from being uploaded.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-11740

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 5

• 🔥 https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18734 · Exploit
• http://manageengine.com · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-11740 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11740 · Nota de Segurança
• http://application.com · Nota