PT-2020-10038 · Microsoft+1 · System Center Configuration Manager+1

Published 2020-03-23 · Updated 2023-02-03 · CVE-2019-19034

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Asset Explorer version 6.5

Description The issue arises from the lack of validation of the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privileges.

Recommendations For Zoho ManageEngine Asset Explorer version 6.5, consider disabling the dynamic command generation for SCCM scans until a patch is available to prevent arbitrary command execution. Restrict access to the AssetExplorer Server to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-19034

Affected Products

System Center Configuration Manager

Zoho Manageengine Assetexplorer

References · 6

• 🔥 http://seclists.org/fulldisclosure/2020/May/36 · Exploit
• 🔥 http://packetstormsecurity.com/files/157731/ManageEngine-AssetExplorer-Authenticated-Command-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19034 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19034 · Vendor Advisory
• https://manageengine.com/products/asset-explorer/sp-readme.html · Vendor Advisory
• https://t.me/cvenotify/2021 · Telegram Post