{"id":"CVE-2018-11808","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-11808","generatedAt":"2026-10-29T02:04:16.683Z","title":"Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is \"NT…","description":"Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is \"NT AUTHORITY / SYSTEM\") by sending a specially crafted request to the server.","published":"2018-06-06T03:29:00.000Z","lastModified":"2026-06-17T01:36:39.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":9.1,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"cwe":["CWE-20"],"affected":["zohocorp/manageengine applications manager"],"epss":{"score":0.06113,"percentile":0.93394,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (6.11%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/104467","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://github.com/kactrosN/publicdisclosures","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.manageengine.com/products/applications_manager/issues.html","tags":["Release Notes","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-11808.html","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/104467","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/kactrosN/publicdisclosures","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.manageengine.com/products/applications_manager/issues.html","tags":["Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-11808.html","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-11808","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}