CVE-2016-9491: ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity
First published: Fri Jul 13 2018(Updated: )
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp ManageEngine Applications Manager | =12.0 | |
| Zohocorp ManageEngine Applications Manager | =13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2016-9491?
CVE-2016-9491 is a vulnerability in ManageEngine Applications Manager 12 and 13 that allows an authenticated user to browse the filesystem and read system files, including private keys.
How severe is CVE-2016-9491?
CVE-2016-9491 has a severity rating of 4.9, which is considered medium.
Which software versions are affected by CVE-2016-9491?
ManageEngine Applications Manager versions 12.0 and 13.0 are affected by CVE-2016-9491.
How can an attacker exploit CVE-2016-9491?
An attacker who has access to the /register.do page in ManageEngine Applications Manager can exploit CVE-2016-9491 to browse the filesystem and read sensitive system files.
Are there any security updates available for CVE-2016-9491?
Yes, security updates are available for CVE-2016-9491. Please refer to the ManageEngine website for more information.
- agent/weakness
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/zohocorp
- canonical/zohocorp manageengine applications manager
- version/zohocorp manageengine applications manager/12.0
- version/zohocorp manageengine applications manager/13.0