PT-2019-7896

CVE-2017-11561

·

Published

2019-05-23

·

Updated

2019-05-24

Description by

CVSS 3.1
6.5
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager version 12.2
Description An issue was discovered that allows an authenticated user to upload any file in the "Group Chat" or "Alarm" section, which can be abused by a malicious user to upload a web shell.
Recommendations For ZOHO ManageEngine OpManager version 12.2, consider restricting file upload capabilities in the "Group Chat" and "Alarm" sections to prevent potential abuse until a fix is available.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-434: Unrestricted Upload of File with Dangerous Type
Related identifiers
CVE-2017-11561
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com