XXE in Manageengine Applications Manager
CVE-2016-9491
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.025 (84.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.026 · newest: 0.025 · change: -0.000
Affected products
- Manageengine Applications Manager — versions 12, 13
- Zohocorp Manageengine Applications Manager — versions 12.0, 13.0
Weakness classification (CWE)
References
- seclists.org/fulldisclosure/2017/Apr/9 (mailing-list, Mailing List, Third Party Advisory)
- www.securityfocus.com/bid/97394/ (VDB Entry, Third Party Advisory, vdb-entry)
- www.manageengine.com/products/applications_manager/security-updates/security-up… (Vendor Advisory)
Frequently asked questions
- What is CVE-2016-9491?
- CVE-2016-9491 is a medium-severity vulnerability in Manageengine Applications Manager, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.9/10. Published 2018-07-13.
- How severe is CVE-2016-9491?
- Medium severity. CVSS v3 base score is 4.9 out of 10.