CVE-2017-11557

Опубликовано: 23 мая 2019

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauthenticated user to view the list of domain names and usernames used in a company's network environment via a userconfiguration.do?method=editUser request.

Ссылки

http://applications.com
Product
http://manageengine.com
Vendor Advisory
https://www.manageengine.com/
Vendor Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18738
Broken Link
Exploit
Third Party Advisory
http://applications.com
Product
http://manageengine.com
Vendor Advisory
https://www.manageengine.com/
Vendor Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18738
Broken Link
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zohocorp:manageengine_applications_manager:12.3:*:*:*:*:*:*:*

EPSS

Процентиль: 75%

0.00873

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-mm67-7974-qm7r