CVE-2016-9491: ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-9491?
CVE-2016-9491 is a vulnerability in ManageEngine Applications Manager 12 and 13 that allows an authenticated user to browse the filesystem and read system files, including private keys.
How severe is CVE-2016-9491?
CVE-2016-9491 has a severity rating of 4.9, which is considered medium.
Which software versions are affected by CVE-2016-9491?
ManageEngine Applications Manager versions 12.0 and 13.0 are affected by CVE-2016-9491.
How can an attacker exploit CVE-2016-9491?
An attacker who has access to the /register.do page in ManageEngine Applications Manager can exploit CVE-2016-9491 to browse the filesystem and read sensitive system files.
Are there any security updates available for CVE-2016-9491?
Yes, security updates are available for CVE-2016-9491. Please refer to the ManageEngine website for more information.