Zoho ManageEngine Desktop Central prior 100251 Log File log file

Summaryinfo

A vulnerability has been found in Zoho ManageEngine Desktop Central and classified as problematic. This vulnerability affects unknown code of the component Log File Handler. Performing a manipulation results in log file. This vulnerability is cataloged as CVE-2018-11717. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in Zoho ManageEngine Desktop Central (Endpoint Management Software). This affects an unknown part of the component Log File Handler. The manipulation with an unknown input leads to a log file vulnerability. CWE is classifying the issue as CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. This is going to have an impact on confidentiality. The summary by CVE is:

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depending on the modules configured) the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the EAS account (an AD account used to send mail), the cleartext password of recovery_password of Android devices, the cleartext password of account "set", the location of devices enrolled in the platform (with UUID and information related to the name of the person at the location), critical information about all enrolled devices such as Serial Number, UUID, Model, Name, and auth_session_token (usable to spoof a terminal identity on the platform), etc.

The bug was discovered 06/20/2018. The weakness was shared 07/16/2018 (Website). The advisory is shared at manageengine.com. This vulnerability is uniquely identified as CVE-2018-11717 since 06/04/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 26 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371076 (Zoho ManageEngine Desktop Central Information Disclosure Vulnerability).

Upgrading to version 100251 eliminates this vulnerability.

The entry VDB-121508 is related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Endpoint Management Software

Vendor

• Zoho ManageEngine

Name

• Desktop Central

License

• commercial

Website

• Vendor: https://www.manageengine.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion