CVE-2019-19774 Security feature bypass in n/a
Attackers can bypass query restrictions to retrieve MD5 hashes of administrative credentials from the database via a specific SQL query.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-19774?
CVE-2019-19774 is a high-severity vulnerability in n/a, published on 13 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data stored in the database, and recover the MD5 hashes of the accounts used to authenticate the ManageEngine platform to the managed machines on the network (most often administrative accounts). Specifically, this bypasses these restrictions: a query cannot mention password, and a query result cannot have a password column.
Which versions are affected by CVE-2019-19774?
It affects 1 product.
Products include Zohocorp Manageengine Eventlog Analyzer.
How do I fix CVE-2019-19774?
No fix has been published for CVE-2019-19774 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-19774 being exploited?
There is no known exploitation of CVE-2019-19774 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5855-w2f6-pwrj.