Security readout for executives and security teams
Plain-English summary
This flaw lets an attacker turn a credential-testing feature in Zoho ManageEngine Applications Manager into remote command execution. Systems running versions before 13.6 build 13640 should be treated as high risk, especially if the application is reachable from untrusted networks.
Executive priority
Prioritize remediation promptly for any exposed instance because the issue can lead to remote command execution in a management platform. Public exploit references increase urgency even without KEV evidence.
Technical view
The publicly accessible testCredential.do endpoint accepts user input while validating supplied credentials. For OfficeSharePointServer checks, username and password values were not properly validated before being passed into a PowerShell execution path, creating command injection and remote code execution exposure in Applications Manager before 13.6 build 13640.
Likely exposure
Exposure is most likely where ManageEngine Applications Manager before 13.6 build 13640 is deployed and reachable by users or networks that are not fully trusted.
Exploitation context
The bundle cites public exploit and Metasploit-related references, so exploit knowledge was public. KEV is false, and the provided sources do not establish confirmed active exploitation.
Researcher notes
The source bundle identifies the vulnerable endpoint, affected version boundary, and injection path, but lacks CVSS, CWE, and detailed affected CPE data. Treat product scoping carefully and verify against vendor advisories.
Mitigation direction
- Upgrade ManageEngine Applications Manager to 13.6 build 13640 or later per vendor guidance.
- Restrict access to Applications Manager interfaces and testing endpoints from untrusted networks.
- Review vendor security updates before relying on compensating controls.
- Prioritize internet-facing or broadly accessible instances first.
Validation and detection
- Inventory all Zoho ManageEngine Applications Manager deployments and record build numbers.
- Confirm no instance is older than 13.6 build 13640.
- Check whether Applications Manager endpoints are reachable from the internet or user networks.
- Review logs around credential-test activity for unexpected or suspicious use.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-7890 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://pentest.blog/advisory-manageengine-applications-manager-remote-code-execution-sqli-and/CVE reference · x_refsource_MISC
- 44274CVE reference · exploit, x_refsource_EXPLOIT-DB
- https://github.com/rapid7/metasploit-framework/pull/9684CVE reference · x_refsource_MISC
- https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-7890.htmlCVE reference · x_refsource_CONFIRM
- https://pitstop.manageengine.com/portal/community/topic/security-vulnerability-issues-fixed-upgrade-to-the-latest-version-of-applications-managerCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.