CVE-2016-9498: ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects
First published: Fri Jul 13 2018(Updated: )
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp ManageEngine Applications Manager | =12.0 | |
| Zohocorp ManageEngine Applications Manager | =13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2016-9498?
CVE-2016-9498 is a vulnerability in ManageEngine Applications Manager 12 and 13 before build 13200 that allows unserialization of unsafe Java objects, which can be exploited by a remote user without authentication to execute remote code and compromise the application and operating system.
How severe is CVE-2016-9498?
CVE-2016-9498 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2016-9498?
ManageEngine Applications Manager versions 12.0 and 13.0 are affected by CVE-2016-9498.
How can CVE-2016-9498 be exploited?
CVE-2016-9498 can be exploited by a remote user without authentication to execute remote code and compromise the application and operating system.
Are there any security updates available for CVE-2016-9498?
Yes, security updates are available for CVE-2016-9498. Please refer to the provided references for more information.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/zohocorp
- canonical/zohocorp manageengine applications manager
- version/zohocorp manageengine applications manager/12.0
- version/zohocorp manageengine applications manager/13.0