CVE-2019-19475 Privilege escalation in n/a
Authenticated users can modify PostgreSQL configuration to execute arbitrary commands and gain full system privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-19475?
CVE-2019-19475 is a high-severity vulnerability in Zohocorp Manageengine Applications Manager, published on 10 Jan 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can exploit privilege escalation and modify PostgreSQL configuration to execute arbitrary command to escalate and gain full system privilege user access and rights over the system.
Weakness: CWE-276
Which versions are affected by CVE-2019-19475?
It affects 1 product.
Products include Zohocorp Manageengine Applications Manager.
How do I fix CVE-2019-19475?
No fix has been published for CVE-2019-19475 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-19475 being exploited?
There is no known exploitation of CVE-2019-19475 in the wild and no public exploit code.
Other vulnerabilities in Zohocorp Manageengine Applications Manager
- CVE-2020-24743 Privilege escalation in n/a
- CVE-2020-27995 SQL injection in n/a
- CVE-2020-15533 SQL injection in n/a
- CVE-2020-15394 SQL injection in n/a
- CVE-2019-19649 SQL injection in n/a
All Zohocorp Manageengine Applications Manager vulnerabilities
Sources
Also known as GHSA-mqfw-c7jj-r9xj.