CVE-2018-11808

moderate-risk
Published 2018-06-06

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is "NT AUTHORITY / SYSTEM") by sending a specially crafted request to the server.

Do I need to act?

~
4.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Zohocorp

References (8)

Third Party Advisory http://www.securityfocus.com/bid/104467
Third Party Advisory https://github.com/kactrosN/publicdisclosures
Release Notes https://www.manageengine.com/products/applications_manager/issues.html
https://www.manageengine.com/products/applications_manager/security-updates/secu...
Third Party Advisory http://www.securityfocus.com/bid/104467
Third Party Advisory https://github.com/kactrosN/publicdisclosures
Release Notes https://www.manageengine.com/products/applications_manager/issues.html
https://www.manageengine.com/products/applications_manager/security-updates/secu...
43
/ 100
moderate-risk
Severity 31/34 · Critical
Exploitability 7/34 · Low
Exposure 5/34 · Minimal