Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2016-9489

ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
certcc

Description

In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ManageEngine Applications Manager

  • 12affected
  • 13affected

References