PT-2019-15901 · Zoho · Zoho Manageengine Applications Manager

Published 2019-12-11 · Updated 2023-02-02 · CVE-2019-19649

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to 13620

Description The issue allows for remote unauthenticated SQL injection. This is achieved via the eventid parameter to the SyncEventServlet endpoint, specifically targeting the doGet function within SyncEventServlet.java.

Recommendations For versions prior to 13620, update to version 13620 or later to resolve the issue. As a temporary workaround, consider restricting access to the SyncEventServlet endpoint to minimize the risk of exploitation. Avoid using the eventid parameter in the affected endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-19649

Affected Products

Zoho Manageengine Applications Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-19649 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19649 · Vendor Advisory
• https://manageengine.com/products/applications_manager/release-notes.html · Vendor Advisory
• https://gitlab.com/eLeN3Re/CVE-2019-19649 · Note