Lucene search

MitreCVE-2018-11808

HistoryJun 06, 2018 - 3:29 a.m.

CVE-2018-11808

2018-06-0603:29:00

CWE-20

mitre

web.nvd.nist.gov

access control

zoho

manageengine

applications manager

cve-2018-11808

security vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

8.9

Confidence

High

EPSS

0.005

Percentile

77.0%

JSON

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is “NT AUTHORITY / SYSTEM”) by sending a specially crafted request to the server.

Affected configurations

Nvd

Node

zohocorpmanageengine_applications_managerMatch13

VendorProductVersionCPE
zohocorpmanageengine_applications_manager13cpe:2.3:a:zohocorp:manageengine_applications_manager:13:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_applications_manager	13	cpe:2.3:a:zohocorp:manageengine_applications_manager:13:::::::*

References

www.securityfocus.com/bid/104467

github.com/kactrosN/publicdisclosures

www.manageengine.com/products/applications_manager/issues.html

www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-11808.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

8.9

Confidence

High

EPSS

0.005

Percentile

77.0%

JSON

Related for CVE-2018-11808