vulnwire
8.8high

CVE-2016-9489

ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass

Published 8 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 77%
Public exploits
0
none known

In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.

Exploit prediction (EPSS)

1.66% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.04.0AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

  • ManageEngine Applications Manager

Classification

Weakness
  • CWE-269 Improper Privilege Management
  • CWE-255 Credentials Management Errors
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • manageengine.com /products/applications_manager/security-updates/security-updates-cve-2016-9489.html · x_refsource_CONFIRM, x_transferred
  • seclists.org /fulldisclosure/2017/Apr/9 · mailing-list, x_refsource_FULLDISC, x_transferred
  • securityfocus.com /bid/97394/ · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.