CVE-2016-9489 ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass
HighCVSS 8.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Zohocorp ManageEngine Applications Manager | = 12.0 | No fix listed |
| Zohocorp ManageEngine Applications Manager | = 13.0 | No fix listed |
| ManageEngine applications manager | = 12 | No fix listed |
| ManageEngine applications manager | = 13 | No fix listed |
References
- 20170404 ManageEngine Applications Manager Multiple Vulnerabilities mailing-list third-party-advisory
- www.manageengine.com vendor-advisory
- 97394 third-party-advisory vdb-entry