SQL Injection in Manageengine Applications Manager
CVE-2016-9488
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injecti…
Vulnerability class: SQL Injection
EPSS: 0.044 (89.2th percentile) — read the EPSS interpretation.
Affected products
- Manageengine Applications Manager — versions 12, 13
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 20170404 ManageEngine Applications Manager Multiple Vulnerabilities (mailing-list, x_refsource_FULLDISC)
- packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XS… (x_refsource_MISC)
- www.manageengine.com/products/applications_manager/security-updates/security-up… (x_refsource_CONFIRM)
- 97394 (vdb-entry, x_refsource_BID)
- packetstormsecurity.com/files/158554/ManageEngine-Applications-Manager-13-SQL-I… (x_refsource_MISC)
Frequently asked questions
- What is CVE-2016-9488?
- CVE-2016-9488 is a vulnerability in Manageengine Applications Manager, classified under SQL Injection. Published 2018-06-05.
- Is CVE-2016-9488 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.