CVE-2016-9498
CVSS V2 High 10
CVSS V3 Critical 9.8
Description
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system.
Overview
- CVE ID
- CVE-2016-9498
- Assigner
- cret@cert.org
- Vulnerability Status
- Modified
- Published Version
- 2018-07-13T20:29:01
- Last Modified Date
- 2019-10-09T23:20:33
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_applications_manager:12.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:zohocorp:manageengine_applications_manager:13.0:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:C/I:C/A:C
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- COMPLETE
- Integrity Impact
- COMPLETE
- Availability Impact
- COMPLETE
- Base Score
- 10
- Severity
- HIGH
- Exploitability Score
- 10
- Impact Score
- 10
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 9.8
- Base Severity
- CRITICAL
- Exploitability Score
- 3.9
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://www.securityfocus.com/bid/97394/ | Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2017/Apr/9 | Mailing List Third Party Advisory |
| https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9498.html | Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2016-9498 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9498 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 17:13:34 | Added to TrackCVE | |||
| 2022-12-03 09:53:12 | cert@cert.org | cret@cert.org | CVE Assigner | updated |
| 2022-12-03 09:53:12 | 2018-07-13T20:29Z | 2018-07-13T20:29:01 | CVE Published Date | updated |
| 2022-12-03 09:53:12 | 2019-10-09T23:20:33 | CVE Modified Date | updated | |
| 2022-12-03 09:53:12 | Modified | Vulnerability Status | updated |