PT-2008-2107 · Zoho · Zoho Manageengine Applications Manager

Published 2008-01-29 · Updated 2017-08-08 · CVE-2008-0475

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager version 8.1 build 8100

Description The issue allows remote attackers to obtain sensitive information via an invalid URI. For example, using the "/-" URI, an attacker can access sensitive data, such as that found in the "Home->Summary" section.

Recommendations For ManageEngine Applications Manager version 8.1 build 8100, consider restricting access to the sensitive information section, such as "Home->Summary", until a fix is available. As a temporary workaround, avoid using invalid URIs, such as "/-", to prevent potential exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-0475

Affected Products

Zoho Manageengine Applications Manager

References · 5

• http://secunia.com/advisories/28332 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0475 · Security Note
• http://securityfocus.com/bid/27443 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39917 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0475 · Note