Vulnerability in N/a
CVE-2018-7890
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing…
EPSS: 0.863 (99.4th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- pentest.blog/advisory-manageengine-applications-manager-remote-code-execution-s… (x_refsource_MISC)
- 44274 (exploit, x_refsource_EXPLOIT-DB)
- 103358 (vdb-entry, x_refsource_BID)
- github.com/rapid7/metasploit-framework/pull/9684 (x_refsource_MISC)
- www.manageengine.com/products/applications_manager/security-updates/security-up… (x_refsource_CONFIRM)
- pitstop.manageengine.com/portal/community/topic/security-vulnerability-issues-f… (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2018-7890?
- CVE-2018-7890 is a vulnerability in N/a. Published 2018-03-08.
- Is CVE-2018-7890 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.