Lucene search

MitreCVE-2018-7890

HistoryMar 08, 2018 - 10:29 p.m.

CVE-2018-7890

2018-03-0822:29:00

CWE-78

mitre

web.nvd.nist.gov

cve-2018-7890

remote code execution

zoho manageengine applications manager

command injection

vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.972

Percentile

99.8%

JSON

A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes, and then executes a PowerShell script. If the specified system is OfficeSharePointServer, then the username and password parameters to this script are not validated, leading to Command Injection.

Affected configurations

Nvd

Node

zohocorpmanageengine_applications_managerRange<13.6

VendorProductVersionCPE
zohocorpmanageengine_applications_manager*cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_applications_manager	*	cpe:2.3:a:zohocorp:manageengine_applications_manager::::::::

References

www.securityfocus.com/bid/103358

github.com/rapid7/metasploit-framework/pull/9684

pentest.blog/advisory-manageengine-applications-manager-remote-code-execution-sqli-and/

pitstop.manageengine.com/portal/community/topic/security-vulnerability-issues-fixed-upgrade-to-the-latest-version-of-applications-manager

www.exploit-db.com/exploits/44274/

www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-7890.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.972

Percentile

99.8%

JSON

Related for CVE-2018-7890