PT-2019-15146
CVE-2019-17421
·
Published
2019-11-21
·
Updated
2021-04-29
Description by
CVSS 3.1
7.8
HighMetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Zoho ManageEngine OpManager version 12.4.072
Zoho ManageEngine Firewall Analyzer version 12.4.072
Description
The issue arises from incorrect file permissions on the packaged Nipper executable file, allowing local users to elevate privileges to root by overwriting this file with a malicious payload.
Recommendations
For Zoho ManageEngine OpManager version 12.4.072, update the file permissions of the Nipper executable to prevent local users from overwriting it.
For Zoho ManageEngine Firewall Analyzer version 12.4.072, update the file permissions of the Nipper executable to prevent local users from overwriting it.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾