CVE-2019-19800

CWE-306 — Missing Authentication CWE-200 — Information Exposure3 documents3 sources

Severity

5.3MEDIUM

EPSS

8.7%

top 7.50%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Applications Manager

Timeline

PublishedFeb 6

Latest updateMay 24

Description

Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages1 packages

▶NVDzohocorp/manageengine_applications_manager14.0

🔴Vulnerability Details

GHSA

GHSA-j2f3-pqjr-mrr9: Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet↗2022-05-24

▶

CVEList

CVE-2019-19800: Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet↗2020-02-06

▶