CVE-2018-16364

Summary

CVE	CVE-2018-16364
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2018-09-26 21:29:00 UTC
Updated	2020-09-29 19:12:00 UTC
Description	A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.

Problem Types: CWE-502

Type	Vendor	Product	Version	Update	Edition	Language
Application	Zohocorp	Manageengine Applications Manager	13.7	-	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13700	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13710	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13720	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13730	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13750	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13760	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13770	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13780	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13790	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	-	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13700	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13710	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13720	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13730	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13750	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13760	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13770	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13780	All	All
Application	Zohocorp	Manageengine Applications Manager	13.7	build13790	All	All

Reference	Source	Link	Tags
ManageEngine Applications Manager Deserialization Unauthenticated RCE · Application Security Blog	MISC	blog.jamesotten.com	Exploit, Mitigation, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.