CVE-2016-9491 XML external entity in Applications Manager
Authenticated attackers can exploit XML external entity flaws to read sensitive system files and configuration data, potentially leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-9491?
CVE-2016-9491 is a medium-severity vulnerability in Zohocorp Manageengine Applications Manager, published on 13 Jul 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system.
Which versions are affected by CVE-2016-9491?
It affects 1 product.
Products include Zohocorp Manageengine Applications Manager.
How do I fix CVE-2016-9491?
No fix has been published for CVE-2016-9491 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-9491 being exploited?
There is no known exploitation of CVE-2016-9491 in the wild and no public exploit code.
Other vulnerabilities in Zohocorp Manageengine Applications Manager
- CVE-2020-24743 Privilege escalation in n/a
- CVE-2020-27995 SQL injection in n/a
- CVE-2020-15533 SQL injection in n/a
- CVE-2020-15394 SQL injection in n/a
- CVE-2019-19649 SQL injection in n/a
All Zohocorp Manageengine Applications Manager vulnerabilities
Sources
Also known as GHSA-9f95-rp9g-wg85.