CVE-2017-11740

In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2019-05-23

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Manageengine Applications Manager (Zohocorp)

References

• http://application.com
• http://manageengine.com
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18734