ManageEngine Applications Manager Information Disclosure Vulnerability in File/Directory Monitor

An information disclosure vulnerability has been identified in ManageEngine Applications Manager versions through 176800. This vulnerability arises in the File/Directory monitor when content checks are enabled and a file containing sensitive information from the Applications Manager directory is monitored. In such cases, the information is exposed through Debug-Info HTML files. The vulnerability allows authenticated users to access encrypted database credentials of Applications Manager, but only if the affected monitor is configured by an Administrator or Delegated Administrator.

Impact

Exploitation of this vulnerability allows for unauthorized access to encrypted database credentials of Applications Manager, which could potentially be decrypted and misused.

Remediation

Users can update to ManageEngine Applications Manager version 176900 or version 176701, both of which address this vulnerability. Instructions for updating are available on the ManageEngine Applications Manager service packs page.