CVE-2017-16924

Опубликовано: 19 фев. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 5

EPSS Низкий

Описание

Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data/<client_id>/collections/##/usermgmt.xml URL, as demonstrated by passwords and Wi-Fi keys. This is fixed in build 100157.

Ссылки

https://github.com/snoonan77/security-research/blob/master/CVE-2017-16924
Third Party Advisory
https://www.manageengine.com/desktop-management-msp/password-encryption-policy-violation.html
Third Party Advisory
https://github.com/snoonan77/security-research/blob/master/CVE-2017-16924
Third Party Advisory
https://www.manageengine.com/desktop-management-msp/password-encryption-policy-violation.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.137:*:*:*:managed_service_providers:*:*:*

EPSS

Процентиль: 82%

0.01728

Низкий

9.8 Critical

CVSS3

5 Medium

CVSS2

Дефекты

CWE-330

Связанные уязвимости

GHSA-63qg-58c5-wrff