CVE-2018-16364

Published: Sep 26, 2018Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.

Affected (10)

Products: Zohocorp: Manageengine Applications Manager

Zohocorp

1 product

Manageengine Applications Manager

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Applications Manager	Version 13.7
Zohocorp Manageengine Applications Manager	Version 13.7 build13700
Zohocorp Manageengine Applications Manager	Version 13.7 build13710
Zohocorp Manageengine Applications Manager	Version 13.7 build13720
Zohocorp Manageengine Applications Manager	Version 13.7 build13730
Zohocorp Manageengine Applications Manager	Version 13.7 build13750
Zohocorp Manageengine Applications Manager	Version 13.7 build13760
Zohocorp Manageengine Applications Manager	Version 13.7 build13770
Zohocorp Manageengine Applications Manager	Version 13.7 build13780
Zohocorp Manageengine Applications Manager	Version 13.7 build13790

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://blog.jamesotten.com/post/applications-manager-rce/

Source: cve@mitre.org

ExploitMitigationThird Party Advisory

https://blog.jamesotten.com/post/applications-manager-rce/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMitigationThird Party Advisory

Timeline

No history available yet.