Improper input validation in Zohocorp Manageengine_applications_manager
CVE-2018-11808
Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by def…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.064 (92.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Zohocorp Manageengine_applications_manager — versions 13
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC, Release Notes, Vendor Advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2018-11808?
- CVE-2018-11808 is a critical-severity vulnerability in Zohocorp Manageengine_applications_manager, classified under Improper Input Validation. CVSS score: 9.1/10. Published 2018-06-06.
- How severe is CVE-2018-11808?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2018-11808 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.