| Vulnerability Details | |
|---|---|
| Impact | CVSS V3 rating: 10.0 (Critical) |
| Reported | 02 November 2016 |
| Fixed | 08 February 2017 |
| Affected Builds | Till Build 13100 |
| Fixed in | Build 13200 |
| Overview | Authorization Bypass / Privilege Escalation |
| Recommended Fix | Upgrade to Applications Manager Version 13200 and above |
In ManageEngine Applications Manager 12 and 13, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.
We recommend that you upgrade to Applications Manager Version 13200 to fix this issue.
Source and Acknowledgements
Find out more about CVE-2018-11808 from the CVE dictionary and NIST NVD.
Other Resources: https://seclists.org/fulldisclosure/2017/Apr/9
For clarification or corrections please contact our support team or email us at appmanager-support@manageengine.com