CVE-2018-11808

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is "NT AUTHORITY / SYSTEM") by sending a specially crafted request to the server.

• CWE-20

• http://www.securityfocus.com/bid/104467Third Party Advisory, VDB Entry
• https://github.com/kactrosN/publicdisclosuresThird Party Advisory
• https://www.manageengine.com/products/applications_manager/issues.htmlRelease Notes, Vendor Advisory
• https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-11808.html
• http://www.securityfocus.com/bid/104467Third Party Advisory, VDB Entry
• https://github.com/kactrosN/publicdisclosuresThird Party Advisory
• https://www.manageengine.com/products/applications_manager/issues.htmlRelease Notes, Vendor Advisory
• https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-11808.html

Published

Jun 6, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-11801SQL injection vulnerability in Apache Fineract before 1.3.0 …
• CVE-2018-11802In Apache Solr, the cluster can be partitioned into multiple…4.3
• CVE-2018-11803Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0…7.5
• CVE-2018-11804Spark's Apache Maven-based build includes a convenience scri…7.5
• CVE-2018-11805In Apache SpamAssassin before 3.4.3, nefarious CF files can …6.7
• CVE-2018-11806m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overfl…8.2
• CVE-2018-1181Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-11813libjpeg 9c has a large loop because read_pixel in rdtarga.c …
• CVE-2018-11816Crafted Binder Request Causes Heap UAF in MediaServer7.8
• CVE-2018-11818In all android releases (Android for MSM, Firefox OS for MSM…
• CVE-2018-11819Use after issue in WLAN function due to multiple ACS scan re…
• CVE-2018-1182An issue was discovered in EMC RSA Identity Governance and L…