PT-2018-5081 · Manageengine · Zoho Manageengine Applications Manager

Lukasz Juszczyk · Published 2018-07-13 · Updated 2019-10-09 · CVE-2016-9491

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 12 through 13 before build 13690

Description The issue allows an authenticated user, likely with administrative privileges, to browse the filesystem and read system files, including configuration and stored private keys, by accessing the "/register.do" page. This is possible because the Application Manager runs with administrative privileges by default, granting access to every directory on the underlying operating system.

Recommendations For ManageEngine Applications Manager versions 12 through 13 before build 13690, update to build 13690 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/register.do" page to minimize the risk of exploitation.

Fix

XXE

Information Disclosure

Weakness Enumeration

CWE-611

CWE-200

Related Identifiers

CVE-2016-9491

Affected Products

Zoho Manageengine Applications Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-9491 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9491 · Vendor Advisory
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9491.html · Vendor Advisory
• https://securityfocus.com/bid/97394 · Note
• http://seclists.org/fulldisclosure/2017/Apr/9 · Note