PT-2020-10167 · Postgresql+1 · Postgresql+1

Ammarit Thongthua + 2 · Published 2020-01-10 · Updated 2023-02-01 · CVE-2019-19475

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager version 14 with Build 14360

Description An issue was discovered in the integrated PostgreSQL component of ManageEngine Applications Manager, where a lack of file permission security allows malicious users in the "Authenticated Users" group to exploit privilege escalation. This can lead to modification of the PostgreSQL configuration, enabling the execution of arbitrary commands to gain full system privilege user access and rights over the system.

Recommendations For ManageEngine Applications Manager version 14 with Build 14360, consider restricting access to the integrated PostgreSQL component to prevent exploitation until a fix is available. As a temporary workaround, review and secure file permissions to prevent unauthorized modifications to the PostgreSQL configuration.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-19475

Affected Products

Zoho Manageengine Applications Manager

Postgresql

References · 3

• https://osv.dev/vulnerability/CVE-2019-19475 · Vendor Advisory
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-19475.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19475 · Security Note