CVE-2018-7890
ManageEngine Applications Manager 13.5 - Remote Code Execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes, and then executes a PowerShell script. If the specified system is OfficeSharePointServer, then the username and password parameters to this script are not validated, leading to Command Injection.
Se ha descubierto un problema de ejecución remota de código en Zoho ManageEngine Applications Manager, en versiones anteriores a la 13.6 (build 13640). El endpoint accesible de forma pública testCredential.do toma múltiples entradas de usuario y valida las credenciales proporcionadas mediante el acceso a un sistema especificado. Este endpoint llama a varias clases internas y, a continuación, ejecuta un script PowerShell. Si el sistema especificado es OfficeSharePointServer, los parámetros username y password de este script no se validan, lo que desemboca en una inyección de comandos.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-03-08 CVE Reserved
- 2018-03-08 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2024-11-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/103358 | Third Party Advisory | |
| https://pitstop.manageengine.com/portal/community/topic/security-vulnerability-issues-fixed-upgrade-to-the-latest-version-of-applications-manager | Third Party Advisory | |
| https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-7890.html | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/44274 | 2024-08-05 | |
| https://github.com/rapid7/metasploit-framework/pull/9684 | 2024-08-05 | |
| https://pentest.blog/advisory-manageengine-applications-manager-remote-code-execution-sqli-and | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Zohocorp Search vendor "Zohocorp" | Manageengine Applications Manager Search vendor "Zohocorp" for product "Manageengine Applications Manager" | < 13.6 Search vendor "Zohocorp" for product "Manageengine Applications Manager" and version " < 13.6" | - |
Affected
| ||||||