Server Side Request Forgery Vulnerability in Zoho ManageEngine AssetExplorer
CVE-2019-12994

9.1CRITICAL

Key Information:

Vendor: Zohocorp
Status: Manageengine Assetexplorer
Vendor: CVE Published:; 8 August 2019

What is CVE-2019-12994?

A vulnerability in Zoho ManageEngine AssetExplorer version 6.2.0 allows for Server Side Request Forgery (SSRF) via the AJaxServlet servlet. This issue arises from improper handling of URL parameters, which can be exploited to make unauthorized requests from the server to internal resources, potentially leading to sensitive information exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://www.excellium-services.com/cert-xlm-advisory/CVE-...

x_refsource_MISC

CVSS V3.1

Score:

9.1

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 8, 2019
Vulnerability Reserved
Jun 28, 2019

JSON

Zohocorp

What is CVE-2019-12994?

Human OS v1.0: Ageing Is an Unpatched Zero-Day Vulnerability.

References

CVSS V3.1

Timeline

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.