Lucene search

[email protected]NVD:CVE-2019-12133

HistoryJun 18, 2019 - 10:15 p.m.

CVE-2019-12133

2019-06-1822:15:12

CWE-732

CWE-427

[email protected]

web.nvd.nist.gov

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

17.3%

JSON

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus.

Affected configurations

Nvd

Node

zohocorpmanageengine_analytics_plusMatch1.0

zohocorpmanageengine_browser_security_plusMatch-

zohocorpmanageengine_desktop_centralMatch10.0.380

zohocorpmanageengine_eventlog_analyzerMatch12.0.2

zohocorpmanageengine_firewallMatch12.0

zohocorpmanageengine_key_manager_plusMatch5.6

zohocorpmanageengine_mobile_device_manager_plusMatch9.0.0

zohocorpmanageengine_netflow_analyzerMatch11.0

zohocorpmanageengine_network_configuration_managerMatch11.0

zohocorpmanageengine_o365_manager_plusMatch4.0

zohocorpmanageengine_opmanagerMatch12.3

zohocorpmanageengine_oputilsMatch11.0

zohocorpmanageengine_password_manager_proMatch9.9

zohocorpmanageengine_patch_connect_plusMatch9.0.0

zohocorpmanageengine_patch_manager_plusMatch9.0.0

zohocorpmanageengine_servicedesk_plusMatch10.0.0

zohocorpmanageengine_supportcenter_plusMatch8.1

zohocorpmanageengine_vulnerability_manager_plusMatch9.0.0

VendorProductVersionCPE
zohocorpmanageengine_analytics_plus1.0cpe:2.3:a:zohocorp:manageengine_analytics_plus:1.0:*:*:*:*:*:*:*
zohocorpmanageengine_browser_security_plus-cpe:2.3:a:zohocorp:manageengine_browser_security_plus:-:*:*:*:*:*:*:*
zohocorpmanageengine_desktop_central10.0.380cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.380:*:*:*:*:*:*:*
zohocorpmanageengine_eventlog_analyzer12.0.2cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:12.0.2:*:*:*:*:*:*:*
zohocorpmanageengine_firewall12.0cpe:2.3:a:zohocorp:manageengine_firewall:12.0:*:*:*:*:*:*:*
zohocorpmanageengine_key_manager_plus5.6cpe:2.3:a:zohocorp:manageengine_key_manager_plus:5.6:*:*:*:*:*:*:*
zohocorpmanageengine_mobile_device_manager_plus9.0.0cpe:2.3:a:zohocorp:manageengine_mobile_device_manager_plus:9.0.0:*:*:*:*:*:*:*
zohocorpmanageengine_netflow_analyzer11.0cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:11.0:*:*:*:*:*:*:*
zohocorpmanageengine_network_configuration_manager11.0cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:11.0:*:*:*:*:*:*:*
zohocorpmanageengine_o365_manager_plus4.0cpe:2.3:a:zohocorp:manageengine_o365_manager_plus:4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_analytics_plus	1.0	cpe:2.3:a:zohocorp:manageengine_analytics_plus:1.0:::::::*
zohocorp	manageengine_browser_security_plus	-	cpe:2.3:a:zohocorp:manageengine_browser_security_plus:-:::::::*
zohocorp	manageengine_desktop_central	10.0.380	cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.380:::::::*
zohocorp	manageengine_eventlog_analyzer	12.0.2	cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:12.0.2:::::::*
zohocorp	manageengine_firewall	12.0	cpe:2.3:a:zohocorp:manageengine_firewall:12.0:::::::*
zohocorp	manageengine_key_manager_plus	5.6	cpe:2.3:a:zohocorp:manageengine_key_manager_plus:5.6:::::::*
zohocorp	manageengine_mobile_device_manager_plus	9.0.0	cpe:2.3:a:zohocorp:manageengine_mobile_device_manager_plus:9.0.0:::::::*
zohocorp	manageengine_netflow_analyzer	11.0	cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:11.0:::::::*
zohocorp	manageengine_network_configuration_manager	11.0	cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:11.0:::::::*
zohocorp	manageengine_o365_manager_plus	4.0	cpe:2.3:a:zohocorp:manageengine_o365_manager_plus:4.0:::::::*

Rows per page:

1-10 of 181

References

github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-007.md

www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

17.3%

JSON

Related for NVD:CVE-2019-12133

cvelist1 cve1 prion1