CVE-2019-19034

Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command…

published March 23, 2020

CVSS
—
EPSS
6%
Percentile
93.3
In the wild
Unconfirmed
What it is

Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privileges.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05967 · 93.3th percentile
Published
2020-03-23T16:09Z
EPSS history
Timeline
  • 23 MAR 16:09Z
    Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command…
    cvelistv5