vulnwire
4.9med

CVE-2016-9491

ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity

Published 8 y ago · modified 4 mo ago · JSON

CVSS
4.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.5%
percentile 85%
Public exploits
0
none known

ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system.

Exploit prediction (EPSS)

2.53% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.04.9CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD2.06.8AV:N/AC:L/Au:S/C:C/I:N/A:N

Affected products

  • ManageEngine Applications Manager

Classification

Weakness
  • CWE-611 Improper Restriction of XML External Entity Reference
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • seclists.org /fulldisclosure/2017/Apr/9 · mailing-list, x_refsource_FULLDISC, x_transferred
  • securityfocus.com /bid/97394/ · vdb-entry, x_refsource_BID, x_transferred
  • manageengine.com /products/applications_manager/security-updates/security-updates-cve-2016-9491.html · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.