PT-2018-10830 · Zoho · Zoho Manageengine Applications Manager

Published 2018-06-06 · Updated 2018-08-07 · CVE-2018-11808

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to 13 build 13740

Description The issue allows an attacker to delete any file and read certain files on the server by sending a specially crafted request. This occurs in the context of the user, which by default is "NT AUTHORITY / SYSTEM".

Recommendations For versions prior to 13 build 13740, update to build 13740 or later to resolve the issue. As a temporary workaround, consider restricting access to the CustomFieldsFeedServlet to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-11808

Affected Products

Zoho Manageengine Applications Manager

References · 6

• https://osv.dev/vulnerability/CVE-2018-11808 · Vendor Advisory
• https://manageengine.com/products/applications_manager/issues.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11808 · Security Note
• https://github.com/kactrosN/publicdisclosures · Note
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-11808.html · Note
• http://securityfocus.com/bid/104467 · Note