CVE-2018-11716

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

14.29%

Published

Jul 16, 2018

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information (private information such as location of enrolled devices, cleartext passwords, patching level, etc.) via a GET request on port 8022, 8443, or 8444.

Weaknesses (CWE)

CWE-532

Affected Products (1)

zohocorp · manageengine_desktop_central (up to 100230)vulnerable

References (4)

https://blog.netxp.fr/manageengine-deep-exploitation/

ExploitThird Party Advisory

https://www.manageengine.com/products/desktop-central/vulnerability-in-log-files.html

Vendor Advisory

https://blog.netxp.fr/manageengine-deep-exploitation/

ExploitThird Party Advisory

https://www.manageengine.com/products/desktop-central/vulnerability-in-log-files.html

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs