CVE-2018-11808
9.1
CRITICAL · CVSS 3.0 · EPSS 6.3% (pctl 93)
In your normal cycle
Critical by CVSS (9.1), but no sign of active exploitation.
Description
Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is "NT AUTHORITY / SYSTEM") by sending a specially crafted request to the server.
Scoring
| CVSS | 9.1 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | 6.34% — more likely to be exploited than 93% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-06-06 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| zohocorp | manageengine applications manager |
References
- http://www.securityfocus.com/bid/104467
- https://github.com/kactrosN/publicdisclosures
- https://www.manageengine.com/products/applications_manager/issues.html
- https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-11808.html
- http://www.securityfocus.com/bid/104467
- https://github.com/kactrosN/publicdisclosures
- https://www.manageengine.com/products/applications_manager/issues.html
- https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-11808.html
→ the Explorer · watch your stack · NVD