ManageEngine Applications Manager < Build 182100 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362647);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id(
    "CVE-2026-86677",
    "CVE-2026-86678",
    "CVE-2026-86679",
    "CVE-2026-86683"
  );
  script_xref(name:"IAVA", value:"2026-A-1083");

  script_name(english:"ManageEngine Applications Manager < Build 182100 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A web application running on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the instance of ManageEngine Applications Manager running on the
remote host is build 182000 or below and is not one of the fixed builds (181104 to 181109, 182001 to 182009). It is,
therefore, affected by multiple vulnerabilities:

  - ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run
    unauthorized SQL commands, potentially gaining administrator access and remote code execution.
    (CVE-2026-86677)

  - ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain
    an administrator's API key and use it to perform administrator-level actions. (CVE-2026-86678)

  - ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change
    the proxy settings. (CVE-2026-86683)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86677.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?17758062");
  # https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86678.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?de0100d1");
  # https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86679.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d8c18307");
  # https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86683.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a90f9aeb");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ManageEngine Applications Manager version 182100 or later, or apply the vendor-supplied fix build
(181104 to 181109, or 182001 to 182009) as applicable.");

  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-86677");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:manageengine:applications_manager");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");
  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("manageengine_applications_manager_detect.nasl");
  script_require_keys("installed_sw/ManageEngine Applications Manager");
  script_require_ports("Services/www", 9090);

  exit(0);
}

include('http.inc');
include('vcf.inc');

var app = 'ManageEngine Applications Manager';

var port = get_http_port(default:9090);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

# The detection plugin registers the dotted short version in 'version' and the
# full comparable build number in the 'Build' extra. Compare on the build.
if (empty_or_null(app_info.Build))
  audit(AUDIT_VER_NOT_GRANULAR, app, port, app_info.version);

app_info.display_version = app_info.version + ' build ' + app_info.Build;
app_info.version = app_info.Build;

# Workaround for the issue with single segment versions
var parsed_version = vcf::parse_version(app_info.Build + '.0');
if (vcf::is_error(parsed_version))
  exit(1, parsed_version.message);
app_info.parsed_version = parsed_version;

# The vendor shipped fixes in three separate build windows. Builds 181104 - 181109
# and 182001 - 182009 are fixed, so they are carved out of the affected range.
var constraints = [
  {'max_version' : '181103', 'fixed_display' : 'Build 181104 / 182001 / 182100'},
  {'min_version' : '181110', 'max_version' : '182000', 'fixed_display' : 'Build 182001 / 182100'}
];

vcf::check_version_and_report(
  app_info : app_info,
  constraints : constraints,
  severity : SECURITY_HOLE
);