CVE-2019-19034

Опубликовано: 23 мар. 2020

Источник: nvd

CVSS3: 7.2

CVSS2: 6.5

EPSS Средний

Описание

Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privileges.

Ссылки

http://packetstormsecurity.com/files/157731/ManageEngine-AssetExplorer-Authenticated-Command-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/May/36
Exploit
Mailing List
Third Party Advisory
https://www.manageengine.com/products/asset-explorer/sp-readme.html
Vendor Advisory
http://packetstormsecurity.com/files/157731/ManageEngine-AssetExplorer-Authenticated-Command-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/May/36
Exploit
Mailing List
Third Party Advisory
https://www.manageengine.com/products/asset-explorer/sp-readme.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.20905

Средний

7.2 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-677g-x5rm-h62c