CVE-2016-9489

CWE-269 — Improper Privilege Management CWE-255 CWE-2643 documents3 sources

Severity

8.8HIGH

EPSS

0.3%

top 47.97%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Manageengine Applications Manager Zohocorp Manageengine Applications Manager

Timeline

PublishedJul 13

Latest updateMay 13

Description

In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5manageengine/applications_manager12, 13+1

▶NVDzohocorp/manageengine_applications_manager12.0, 13.0+1

🔴Vulnerability Details

GHSA

GHSA-76xw-q73v-w245: In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own g↗2022-05-13

▶

CVEList

ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass↗2018-07-13

▶