Vulnerability Details CVE-2017-16924
Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data/<client_id>/collections/##/usermgmt.xml URL, as demonstrated by passwords and Wi-Fi keys. This is fixed in build 100157.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.018
EPSS Ranking 81.9%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 5.0
References
- https://github.com/snoonan77/security-research/blob/master/CVE-2017-16924
- https://www.manageengine.com/desktop-management-msp/password-encryption-policy-violation.html
- https://github.com/snoonan77/security-research/blob/master/CVE-2017-16924
- https://www.manageengine.com/desktop-management-msp/password-encryption-policy-violation.html
Products affected by CVE-2017-16924
-
cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.137