Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is "NT AUTHORITY / SYSTEM") by sending a specially crafted request to the server.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/104467 | Third Party Advisory VDB Entry |
https://github.com/kactrosN/publicdisclosures | Third Party Advisory |
https://www.manageengine.com/products/applications_manager/issues.html | Release Notes Vendor Advisory |
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-11808.html |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2018-06-06T03:00:00
Updated: 2018-08-06T20:57:01
Reserved: 2018-06-05T00:00:00
Link: CVE-2018-11808
JSON object: View
NVD Information
Status : Modified
Published: 2018-06-06T03:29:00.247
Modified: 2018-08-07T01:29:02.657
Link: CVE-2018-11808
JSON object: View
Redhat Information
No data.
CWE