CVE-2019-19799

CWE-306 — Missing Authentication CWE-200 — Information Exposure3 documents3 sources

Severity

5.3MEDIUM

EPSS

6.9%

top 8.61%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Applications Manager

Timeline

PublishedMar 13

Latest updateMay 24

Description

Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages1 packages

▶NVDzohocorp/manageengine_applications_manager< 14.5+1

🔴Vulnerability Details

GHSA

GHSA-v4fh-4pmv-92gc: Zoho ManageEngine Applications Manager 14590 and before allows a remote unauthenticated attacker to disclose license related information via WieldFeed↗2022-05-24

▶

CVEList

CVE-2019-19799: Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServ↗2020-03-13

▶