PT-2019-15950 · Zoho · Zoho Manageengine Eventlog Analyzer

Published 2019-12-13 · Updated 2023-02-15 · CVE-2019-19774

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine EventLog Analyzer versions 10.0 SP1 before Build 12110

Description An issue was discovered that allows bypassing security restrictions, enabling the recovery of MD5 hashes of accounts used to authenticate the ManageEngine platform to managed machines on the network. This is achieved by running a specific query at the "/event/runquery.do" endpoint, which bypasses restrictions that prevent viewing credential data stored in the database. The query "select hostdetails from hostdetails" can be used to exploit this issue, allowing access to sensitive information.

Recommendations For Zoho ManageEngine EventLog Analyzer versions 10.0 SP1 before Build 12110, consider disabling access to the "/event/runquery.do" endpoint until a patch is available. Restrict the use of queries that can bypass security restrictions, such as those mentioning hostdetails, to minimize the risk of exploitation. Update to a version that includes the fix, specifically Build 12110 or later, to fully resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2019-19774

Affected Products

Zoho Manageengine Eventlog Analyzer

References · 7

• 🔥 http://packetstormsecurity.com/files/156485/ManageEngine-EventLog-Analyzer-10.0-Information-Disclosure.html · Exploit
• 🔥 https://exploit-db.com/exploits/48119 · Exploit
• https://osv.dev/vulnerability/CVE-2019-19774 · Vendor Advisory
• https://manageengine.com/products/eventlog/features-new.html#release · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19774 · Security Note
• https://t.me/cvenotify/44319 · Telegram Post
• https://gist.github.com/scottgoodwin90/19ccecdc9f5733c0a9381765cfc7fe39 · Note