Back
CVE-2016-9491
ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity
Medium4.9EPSS 2.5%
- Published
- Updated
- Reserved
- Assigned by
- certcc
Description
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Medium4.9 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 2.5% · top 15% of all CVEs (2 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.9.
Weakness
Affected products
ManageEngine · Applications Manager
- affected 12
- affected 13
References (3)
- 20170404 ManageEngine Applications Manager Multiple Vulnerabilities (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- 97394 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9491.html (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Record last updated .