Abstract Advisory Information
A service exposed by the software allows to a basic user to perform a Server Side Request Forgery attack. This attack can also leveraged via a CSRF attack.
Authors: Dominique Righetto
Version affected
Name : AssetExplorer
Product version: 6.2.0
Common Vulnerability Scoring System
5.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Patches
The vulnerability is patched in version 6.5 Build 6502
References
https://www.manageengine.com/products/asset-explorer/sp-readme.html
Vulnerability Disclosure Timeline
- 04-05-2019: Vulnerability identification
- 06-05-2019: First contact with the vendor
- 06-05-2019: Acknowledge from the vendor
- 24-06-2019: Vulnerability patched by vendor
- 25-06-2019: CVE assigned by Mitre
- 17-07-2019: Patch release by vendor
- 06-08-2019: Public disclosure
