PT-2020-10241 · Zoho · Zoho Manageengine Applications Manager

Published 2020-02-06 · Updated 2021-07-21 · CVE-2019-19800

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to 14520

Description The issue allows a remote unauthenticated attacker to disclose OS file names via the FailOverHelperServlet.

Recommendations For versions prior to 14520, update to version 14520 or later to resolve the issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-19800

Affected Products

Zoho Manageengine Applications Manager

References · 6

• https://osv.dev/vulnerability/CVE-2019-19800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19800 · Security Note
• https://manageengine.com · Note
• https://t.me/cvenotify/852 · Telegram Post
• https://manageengine.com/products/applications_manager/release-notes.html · Note
• https://gitlab.com/eLeN3Re/CVE-2019-19800 · Note