CVE-2016-9488CWE-89

CVE-2016-9488: falha em ManageEngine Applications Manager

ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Applications Manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

23Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendepss 4.6%
da publicação à arma782 dias
Publicada no NVD5 de jun.
1ª PoC+782d
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.
Produtos afetados
ManageEngine · Applications Manager
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — ManageEngine Applications Manager

No mesmo produto, das mais perigosas para as menos.

CVE-2016-9498—ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objectsEPSS 21.2%CVE-2024-5678MEDIUMSQL InjectionEPSS 5.0%CVE-2016-9491—ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entityEPSS 2.5%CVE-2016-9490—ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerabilityEPSS 1.7%CVE-2016-9489—ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypassEPSS 1.7%CVE-2024-41140HIGHImproper AuthorizationEPSS 1.0%