CVE-2016-9488CWE-89

CVE-2016-9488: fallo en ManageEngine Applications Manager

ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Applications Manager

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

23Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendepss 4.6%
de la publicación al arma782 días
Publicada en NVD5 jun
1ª PoC+782d
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.
Productos afectados
ManageEngine · Applications Manager
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — ManageEngine Applications Manager

En el mismo producto, de las más peligrosas a las menos.

CVE-2016-9498—ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objectsEPSS 21.2%CVE-2024-5678MEDIUMSQL InjectionEPSS 5.0%CVE-2016-9491—ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entityEPSS 2.5%CVE-2016-9490—ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerabilityEPSS 1.7%CVE-2016-9489—ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypassEPSS 1.7%CVE-2024-41140HIGHImproper AuthorizationEPSS 1.0%