CVE-2016-9489
Summary
| CVE | CVE-2016-9489 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-07-13 20:29:00 UTC |
| Updated | 2019-10-09 23:20:00 UTC |
| Description | In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password. |
Risk And Classification
Problem Types: CWE-255 | CWE-264
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Zohocorp | Manageengine Applications Manager | 12.0 | All | All | All |
| Application | Zohocorp | Manageengine Applications Manager | 13.0 | All | All | All |
| Application | Zohocorp | Manageengine Applications Manager | 12.0 | All | All | All |
| Application | Zohocorp | Manageengine Applications Manager | 13.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Full Disclosure: ManageEngine Applications Manager Multiple Vulnerabilities | FULLDISC | seclists.org | Mailing List, Third Party Advisory |
| Security Updates - CVE Details | ManageEngine Applications Manager | CONFIRM | www.manageengine.com | Vendor Advisory |
| ManageEngine Applications Manager Multiple Security Vulnerabilities | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| ManageEngine Applications Manager Multiple Security Vulnerabilities | MITRE | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Thanks to Lukasz Juszczyk for reporting this vulnerability.
There are currently no legacy QID mappings associated with this CVE.