Vulnerabilities in ManageEngine Apps Leads Enterprise Systems to Threats

Flaw researchers have revealed numerous serious flaws in ManageEngine’s line of tools for inner IT support teams, which are employed by about partial of 500 Fortune companies. The initial flaw marks EventLog Analyzer 11.8 and Log360 5.3, and could be oppressed to accomplish distant code implementation with the same rights as the customers that functioned the application, by uploading a web shell to be inscribed to the web source.

Here are rest of the flaws that are found in Applications Manager 13:

1. Numerous unreliable blind SQL injections. The vulnerabilities can open to full settlement of the Applications Manager application, which can be influenced to function random code as SYSTEM when functioning on Windows, causing in entire host conciliation.
2. An unreliable local file annexation flaw that can be altered for disinterring complex information.
3. An unreliable API key revelation flaw that could be influenced to conciliation the application and the host.
4. Further precise information can be attained in the advisory.

Fixes Area Accessible

ManageEngine has been notified of the flaws and has already stimulated to resolve the issue which is a great news from the center.

“ManageEngine has addressed the vulnerabilities and is making patches available for each of the affected applications. Patches can be downloaded from the ManageEngine site,” the researchers noted.