CVE-2018-11808 Missing authorization in n/a
An attacker can delete arbitrary files and read sensitive data on the server by exploiting missing access controls in the CustomFieldsFeedServlet.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11808?
CVE-2018-11808 is a critical missing authorization vulnerability in Zohocorp Manageengine Applications Manager, published on 6 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is "NT AUTHORITY / SYSTEM") by sending a specially crafted request to the server.
Weakness: CWE-20
Which versions are affected by CVE-2018-11808?
It affects 1 product.
Products include Zohocorp Manageengine Applications Manager.
How do I fix CVE-2018-11808?
No fix has been published for CVE-2018-11808 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-11808 being exploited?
There is no known exploitation of CVE-2018-11808 in the wild and no public exploit code.
Other vulnerabilities in Zohocorp Manageengine Applications Manager
- CVE-2020-24743 Privilege escalation in n/a
- CVE-2020-27995 SQL injection in n/a
- CVE-2020-15533 SQL injection in n/a
- CVE-2020-15394 SQL injection in n/a
- CVE-2019-19649 SQL injection in n/a
All Zohocorp Manageengine Applications Manager vulnerabilities
Sources
Also known as GHSA-rh5r-wvg8-j97g.