CVE-2018-18980

Published: Nov 6, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

Affected (2)

Products: Zohocorp: Manageengine Network Configuration Manager, Manageengine Opmanager

2 products

Manageengine Network Configuration Manager

Manageengine Opmanager

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Network Configuration Manager	Before 12.3.214
Zohocorp Manageengine Opmanager	Before 12.3.214

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (4)

https://github.com/x-f1v3/ForCve/issues/5

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.manageengine.com/network-monitoring/help/read-me.html

Source: cve@mitre.org

Vendor Advisory

https://github.com/x-f1v3/ForCve/issues/5

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.manageengine.com/network-monitoring/help/read-me.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.