Lucene search

[email protected]CVE-2018-16364

HistorySep 26, 2018 - 9:29 p.m.

CVE-2018-16364

2018-09-2621:29:01

CWE-502

[email protected]

web.nvd.nist.gov

cve-2018-16364

zoho manageengine

applications manager

serialization vulnerability

remote code execution

windows

smb share

nvd

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

72.7%

JSON

A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.

Affected configurations

NVD

Node

zohocorpmanageengine_applications_managerMatch13.7-

zohocorpmanageengine_applications_managerMatch13.7build13700

zohocorpmanageengine_applications_managerMatch13.7build13710

zohocorpmanageengine_applications_managerMatch13.7build13720

zohocorpmanageengine_applications_managerMatch13.7build13730

zohocorpmanageengine_applications_managerMatch13.7build13750

zohocorpmanageengine_applications_managerMatch13.7build13760

zohocorpmanageengine_applications_managerMatch13.7build13770

zohocorpmanageengine_applications_managerMatch13.7build13780

zohocorpmanageengine_applications_managerMatch13.7build13790

CPENameOperatorVersion
zohocorp:manageengine_applications_managerzohocorp manageengine applications managereq13.7

CPE	Name	Operator	Version
zohocorp:manageengine_applications_manager	zohocorp manageengine applications manager	eq	13.7

References

blog.jamesotten.com/post/applications-manager-rce/

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

72.7%

JSON

Related for CVE-2018-16364

nvd1 cvelist1 prion1