XXE in Manageengine Applications Manager
CVE-2016-9491
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Appl…
Vulnerability class: XXE (XML External Entity)
EPSS: 0.007 (73.2th percentile) — read the EPSS interpretation.
Affected products
- Manageengine Applications Manager — versions 12, 13
Weakness classification (CWE)
References
- 20170404 ManageEngine Applications Manager Multiple Vulnerabilities (mailing-list, x_refsource_FULLDISC)
- 97394 (vdb-entry, x_refsource_BID)
- www.manageengine.com/products/applications_manager/security-updates/security-up… (x_refsource_CONFIRM)