PT-2019-7902 · Zoho · Zoho Manageengine Applications Manager

Published 2019-05-23 · Updated 2019-05-23 · CVE-2017-11740

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager version 13.1 Build 13100

Description The issue allows an administrative user to upload files or binaries that can be executed when an alarm occurs. An attacker can exploit this functionality by uploading a malicious script, which can then be executed on the remote system.

Recommendations For Zoho ManageEngine Application Manager version 13.1 Build 13100, consider restricting the upload functionality for administrative users to prevent the execution of malicious scripts until a fix is available. As a temporary workaround, limit the types of files that can be uploaded to prevent executable binaries from being uploaded.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-11740

Affected Products

Zoho Manageengine Applications Manager

References · 5

• 🔥 https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18734 · Exploit
• http://manageengine.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11740 · Security Note
• http://application.com · Note