Incorrect default permissions in ManageEngine Applications Manager - CVE-2019-19475
Published: January 10, 2020 / Updated: August 8, 2020
Vulnerability identifier: #VU34877
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2019-19475
CWE-ID: CWE-276
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Zoho Corporation
Affected software:
ManageEngine Applications Manager
ManageEngine Applications Manager
Detailed vulnerability description
The vulnerability allows a remote authenticated user to execute arbitrary code.
An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can exploit privilege escalation and modify PostgreSQL configuration to execute arbitrary command to escalate and gain full system privilege user access and rights over the system.
How to mitigate CVE-2019-19475
Install update from vendor's website.