#VU36901 Credentials management in ManageEngine Applications Manager - CVE-2016-9489

Vulnerability identifier: #VU36901

Vulnerability risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-9489

CWE-ID: CWE-255

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
ManageEngine Applications Manager
Server applications / Remote management servers, RDP, SSH

Vendor: Zoho Corporation

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.

Mitigation
Install update from vendor's website.

Vulnerable software versions

ManageEngine Applications Manager : 12.0 - 13.0

---

External links
https://seclists.org/fulldisclosure/2017/Apr/9
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9489.html
https://www.securityfocus.com/bid/97394/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.