CVE-2018-16364

CWE-502 — Deserialization of Untrusted Data3 documents3 sources

Severity

8.1HIGH

EPSS

2.2%

top 15.43%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Applications Manager

Timeline

PublishedSep 26

Latest updateMay 13

Description

A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages1 packages

▶NVDzohocorp/manageengine_applications_manager13.7

🔴Vulnerability Details

GHSA

GHSA-5q6m-246p-3pgg: A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload o↗2022-05-13

▶

CVEList

CVE-2018-16364: A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload o↗2018-09-26

▶