Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-17421

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.

Published

2019-11-21T15:15:14.790

Last Modified

2024-11-21T04:32:18.050

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.9

Impact Score

10.0

Weaknesses

Type: Primary
CWE-276

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	zohocorp	manageengine_firewall_analyzer	12.4	Yes
Application	zohocorp	manageengine_opmanager	12.4	Yes

References

https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html Third Party Advisory ([email protected])
https://twitter.com/va_start Exploit, Third Party Advisory ([email protected])
https://www.manageengine.com/products/firewall/security-updates/cve-2019-17421.html Patch, Vendor Advisory ([email protected])
https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://twitter.com/va_start Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.manageengine.com/products/firewall/security-updates/cve-2019-17421.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)