ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity

ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system.

N/A

XML外部实体引用的不恰当限制(XXE)

ZOHO ManageEngine Applications Manager 信息泄露漏洞

ZOHO ManageEngine Applications Manager是美国卓豪（ZOHO）公司的一套应用性能监控软件。该软件可对不同的业务系统、应用和网络服务（如服务器、操作系统等）进行远程监控和管理。 ZOHO ManageEngine Applications Manager 12版本和13版本中存在信息泄露漏洞。远程攻击者可利用该漏洞读取系统文件并可能访问底层操作系统上的任意目录。

N/A

N/A