cnvd - cnvd-2019-21113

CNVD-2019-21113

Vulnerability from cnvd - Published: 2019-07-04

Title

多款ZOHO产品授权问题漏洞

Description

ZOHO ManageEngine Desktop Central（DC）等都是美国卓豪（ZOHO）公司的产品。ManageEngine Desktop Central是一套桌面管理解决方案。ZOHO ManageEngine ServiceDesk Plus是一套基于ITIL架构的IT服务管理软件（ITSM）。ZOHO ManageEngine EventLog Analyzer是一套系统、事件日志分析软件。多款ZOHO产品中存在授权问题漏洞，该漏洞源于程序未能为%SYSTEMDRIVE%ManageEngine目录及其子文件夹分配正确的权限，攻击者可利用该漏洞提升权限至NT AUTHORITYSYSTEM权限。

Severity

高

Patch Name

多款ZOHO产品授权问题漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html

Reference

https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html https://github.com/active-labs/Advisories/blob/master/ACTIVE-2019-007.md

Impacted products

Name
['ZOHO ManageEngine SupportCenter Plus 8.1.0', 'ZOHO ManageEngine OpManager 12.3', 'ZOHO ManageEngine Desktop Central 10.0.380', 'ZOHO ManageEngine EventLog Analyzer 12.0.2', 'ZOHO ManageEngine ServiceDesk Plus 10.0.0', 'ZOHO O365 Manager Plus 4.0', 'ZOHO Mobile Device Manager Plus 9.0.0', 'ZOHO Patch Connect Plus 9.0.0', 'ZOHO Vulnerability Manager Plus 9.0.0', 'ZOHO Patch Manager Plus 9.0.0', 'ZOHO NetFlow Analyzer 11.0', 'ZOHO ManageEngine OpUtils 11.0', 'ZOHO Manage Engine Network Configuration Manager 11.0', 'ZOHO FireWall 12.0', 'ZOHO Key Manager Plus 5.6', 'ZOHO ManageEngine Password Manager Pro（PMP） 9.9', 'ZOHO Analytics Plus 1.0', 'ZOHO Browser Security Plus']

Name

['ZOHO ManageEngine SupportCenter Plus 8.1.0', 'ZOHO ManageEngine OpManager 12.3', 'ZOHO ManageEngine Desktop Central 10.0.380', 'ZOHO ManageEngine EventLog Analyzer 12.0.2', 'ZOHO ManageEngine ServiceDesk Plus 10.0.0', 'ZOHO O365 Manager Plus 4.0', 'ZOHO Mobile Device Manager Plus 9.0.0', 'ZOHO Patch Connect Plus 9.0.0', 'ZOHO Vulnerability Manager Plus 9.0.0', 'ZOHO Patch Manager Plus 9.0.0', 'ZOHO NetFlow Analyzer 11.0', 'ZOHO ManageEngine OpUtils 11.0', 'ZOHO Manage Engine Network Configuration Manager 11.0', 'ZOHO FireWall 12.0', 'ZOHO Key Manager Plus 5.6', 'ZOHO ManageEngine Password Manager Pro（PMP） 9.9', 'ZOHO Analytics Plus 1.0', 'ZOHO Browser Security Plus']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-12133"
    }
  },
  "description": "ZOHO ManageEngine Desktop Central\uff08DC\uff09\u7b49\u90fd\u662f\u7f8e\u56fd\u5353\u8c6a\uff08ZOHO\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002ManageEngine Desktop Central\u662f\u4e00\u5957\u684c\u9762\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002ZOHO ManageEngine ServiceDesk Plus\u662f\u4e00\u5957\u57fa\u4e8eITIL\u67b6\u6784\u7684IT\u670d\u52a1\u7ba1\u7406\u8f6f\u4ef6\uff08ITSM\uff09\u3002ZOHO ManageEngine EventLog Analyzer\u662f\u4e00\u5957\u7cfb\u7edf\u3001\u4e8b\u4ef6\u65e5\u5fd7\u5206\u6790\u8f6f\u4ef6\u3002\n\n\u591a\u6b3eZOHO\u4ea7\u54c1\u4e2d\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u4e3a%SYSTEMDRIVE%ManageEngine\u76ee\u5f55\u53ca\u5176\u5b50\u6587\u4ef6\u5939\u5206\u914d\u6b63\u786e\u7684\u6743\u9650\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63d0\u5347\u6743\u9650\u81f3NT AUTHORITYSYSTEM\u6743\u9650\u3002",
  "discovererName": "Hashim Jawad",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-21113",
  "openTime": "2019-07-04",
  "patchDescription": "ZOHO ManageEngine Desktop Central\uff08DC\uff09\u7b49\u90fd\u662f\u7f8e\u56fd\u5353\u8c6a\uff08ZOHO\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002ManageEngine Desktop Central\u662f\u4e00\u5957\u684c\u9762\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002ZOHO ManageEngine ServiceDesk Plus\u662f\u4e00\u5957\u57fa\u4e8eITIL\u67b6\u6784\u7684IT\u670d\u52a1\u7ba1\u7406\u8f6f\u4ef6\uff08ITSM\uff09\u3002ZOHO ManageEngine EventLog Analyzer\u662f\u4e00\u5957\u7cfb\u7edf\u3001\u4e8b\u4ef6\u65e5\u5fd7\u5206\u6790\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u6b3eZOHO\u4ea7\u54c1\u4e2d\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u4e3a%SYSTEMDRIVE%ManageEngine\u76ee\u5f55\u53ca\u5176\u5b50\u6587\u4ef6\u5939\u5206\u914d\u6b63\u786e\u7684\u6743\u9650\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63d0\u5347\u6743\u9650\u81f3NT AUTHORITYSYSTEM\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eZOHO\u4ea7\u54c1\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "ZOHO ManageEngine SupportCenter Plus 8.1.0",
      "ZOHO ManageEngine OpManager 12.3",
      "ZOHO ManageEngine Desktop Central 10.0.380",
      "ZOHO ManageEngine EventLog Analyzer  12.0.2",
      "ZOHO ManageEngine ServiceDesk Plus 10.0.0",
      "ZOHO O365 Manager Plus 4.0",
      "ZOHO Mobile Device Manager Plus 9.0.0",
      "ZOHO Patch Connect Plus 9.0.0",
      "ZOHO Vulnerability Manager Plus 9.0.0",
      "ZOHO Patch Manager Plus 9.0.0",
      "ZOHO NetFlow Analyzer 11.0",
      "ZOHO ManageEngine OpUtils 11.0",
      "ZOHO Manage Engine Network Configuration Manager 11.0",
      "ZOHO FireWall 12.0",
      "ZOHO Key Manager Plus 5.6",
      "ZOHO ManageEngine Password Manager Pro\uff08PMP\uff09 9.9",
      "ZOHO Analytics Plus 1.0",
      "ZOHO Browser Security Plus"
    ]
  },
  "referenceLink": "https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html\r\nhttps://github.com/active-labs/Advisories/blob/master/ACTIVE-2019-007.md",
  "serverity": "\u9ad8",
  "submitTime": "2019-06-19",
  "title": "\u591a\u6b3eZOHO\u4ea7\u54c1\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2019-12133 (GCVE-0-2019-12133)

Vulnerability from cvelistv5 – Published: 2019-06-18 21:27 – Updated: 2024-08-04 23:10

Summary

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://www.manageengine.com/products/desktop-cen…	x_refsource_CONFIRM
	https://github.com/active-labs/Advisories/blob/ma…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:10:30.563Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-007.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-04-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-18T18:00:42",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-007.md"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-12133",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html",
              "refsource": "CONFIRM",
              "url": "https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html"
            },
            {
              "name": "https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-007.md",
              "refsource": "MISC",
              "url": "https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-007.md"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-12133",
    "datePublished": "2019-06-18T21:27:25",
    "dateReserved": "2019-05-15T00:00:00",
    "dateUpdated": "2024-08-04T23:10:30.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-21113

CVE-2019-12133 (GCVE-0-2019-12133)

Tags

Sightings

Nomenclature