// For flags

CVE-2016-9489

ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.

En ManageEngine Applications Manager 12 y 13, antes de la build 13200, un usuario autenticado puede alterar todas sus propiedades, incluyendo su propio grupo; p. ej., cambiando su grupo a otro con mayores privilegios como "ADMIN". Un usuario también puede cambiar las propiedades de otro usuario, p. ej., cambiando la contraseña de otro usuario.

ManageEngine Applications Manager versions 12 and 13 suffers from code execution, cross site scripting, XXE injection, and remote SQL injection vulnerabilities.

*Credits: Thanks to Lukasz Juszczyk for reporting this vulnerability.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2016-11-21 CVE Reserved
  • 2017-04-04 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-255: Credentials Management Errors
  • CWE-264: Permissions, Privileges, and Access Controls
  • CWE-269: Improper Privilege Management
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zohocorp
Search vendor "Zohocorp"
 Manageengine Applications Manager
Search vendor "Zohocorp" for product "Manageengine Applications Manager"
 12.0
Search vendor "Zohocorp" for product "Manageengine Applications Manager" and version "12.0"
-
Affected
Zohocorp
Search vendor "Zohocorp"
 Manageengine Applications Manager
Search vendor "Zohocorp" for product "Manageengine Applications Manager"
 13.0
Search vendor "Zohocorp" for product "Manageengine Applications Manager" and version "13.0"
-
Affected