PT-2018-5079 · Zoho · Zoho Manageengine Applications Manager

Lukasz Juszczyk · Published 2018-07-13 · Updated 2019-10-09 · CVE-2016-9489

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 12 through 13 before build 13200

Description The issue allows an authenticated user to modify their own properties, including their group membership, potentially escalating their privileges to a higher level, such as "ADMIN". Additionally, a user can alter properties of another user, including changing their password.

Recommendations For ManageEngine Applications Manager versions 12 through 13 before build 13200, update to build 13200 or later to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-255

CWE-264

CWE-269

Related Identifiers

CVE-2016-9489

Affected Products

Zoho Manageengine Applications Manager

References · 5

• https://osv.dev/vulnerability/CVE-2016-9489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9489 · Security Note
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9489.html · Vendor Advisory
• https://securityfocus.com/bid/97394 · Note
• http://seclists.org/fulldisclosure/2017/Apr/9 · Note