Vulnerabilities > CVE-2018-16364 - Deserialization of Untrusted Data vulnerability in Zohocorp Manageengine Applications Manager

CVSS 9.3 - CRITICAL

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

zohocorp

CWE-502

critical

NVD

Published: 2018-09-26

Updated: 2018-12-20

Summary

A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.

Vulnerable Configurations

Part	Description	Count
Application	Zohocorp Zohocorp Manageengine Applications Manager 11.0 Zohocorp Manageengine Applications Manager 11.1 Zohocorp Manageengine Applications Manager 11.2 Zohocorp Manageengine Applications Manager 11.3 Zohocorp Manageengine Applications Manager 11.4 Zohocorp Manageengine Applications Manager 11.5 Zohocorp Manageengine Applications Manager 11.6 Zohocorp Manageengine Applications Manager 11.7 Zohocorp Manageengine Applications Manager 11.8 Zohocorp Manageengine Applications Manager 11.9 Zohocorp Manageengine Applications Manager 12.0 Zohocorp Manageengine Applications Manager 12.1 Zohocorp Manageengine Applications Manager 12.2 Zohocorp Manageengine Applications Manager 12.3 Zohocorp Manageengine Applications Manager 12.4 Zohocorp Manageengine Applications Manager 12.5 Zohocorp Manageengine Applications Manager 12.6 Zohocorp Manageengine Applications Manager 12.7 Zohocorp Manageengine Applications Manager 12.8 Zohocorp Manageengine Applications Manager 12.9 Zohocorp Manageengine Applications Manager 13.0 Zohocorp Manageengine Applications Manager 13.1 Zohocorp Manageengine Applications Manager 13.2 Zohocorp Manageengine Applications Manager 13.3 Zohocorp Manageengine Applications Manager 13.4 Zohocorp Manageengine Applications Manager 13.5 Zohocorp Manageengine Applications Manager 13.6 Zohocorp Manageengine Applications Manager 13.7 Zohocorp Manageengine Applications Manager 13.8 Zohocorp Manageengine Applications Manager 13.9 Zohocorp Manageengine Applications Manager 13.13820 Zohocorp Manageengine Applications Manager 14.0 Zohocorp Manageengine Applications Manager 14.1 Zohocorp Manageengine Applications Manager 14.2 Zohocorp Manageengine Applications Manager 14.5	106

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

References

https://blog.jamesotten.com/post/applications-manager-rce/