CVE-2018-20173

nvd nist

Published: Dec 17, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.

Affected (89)

Products: Zohocorp: Manageengine Opmanager

Zohocorp

1 product

Manageengine Opmanager

Configuration A

89 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Opmanager	Version 12.3 build123001
Zohocorp Manageengine Opmanager	Version 12.3 build123002
Zohocorp Manageengine Opmanager	Version 12.3 build123003
Zohocorp Manageengine Opmanager	Version 12.3 build123004
Zohocorp Manageengine Opmanager	Version 12.3 build123005
Zohocorp Manageengine Opmanager	Version 12.3 build123006
Zohocorp Manageengine Opmanager	Version 12.3 build123007
Zohocorp Manageengine Opmanager	Version 12.3 build123008
Zohocorp Manageengine Opmanager	Version 12.3 build123009
Zohocorp Manageengine Opmanager	Version 12.3 build12300
Zohocorp Manageengine Opmanager	Version 12.3 build123010
Zohocorp Manageengine Opmanager	Version 12.3 build123011
Zohocorp Manageengine Opmanager	Version 12.3 build123012
Zohocorp Manageengine Opmanager	Version 12.3 build123013
Zohocorp Manageengine Opmanager	Version 12.3 build123014
Zohocorp Manageengine Opmanager	Version 12.3 build123015
Zohocorp Manageengine Opmanager	Version 12.3 build123021
Zohocorp Manageengine Opmanager	Version 12.3 build123022
Zohocorp Manageengine Opmanager	Version 12.3 build123023
Zohocorp Manageengine Opmanager	Version 12.3 build123024
Zohocorp Manageengine Opmanager	Version 12.3 build123025
Zohocorp Manageengine Opmanager	Version 12.3 build123026
Zohocorp Manageengine Opmanager	Version 12.3 build123027
Zohocorp Manageengine Opmanager	Version 12.3 build123028
Zohocorp Manageengine Opmanager	Version 12.3 build123029
Zohocorp Manageengine Opmanager	Version 12.3 build123030
Zohocorp Manageengine Opmanager	Version 12.3 build123031
Zohocorp Manageengine Opmanager	Version 12.3 build123032
Zohocorp Manageengine Opmanager	Version 12.3 build123033
Zohocorp Manageengine Opmanager	Version 12.3 build123034
Zohocorp Manageengine Opmanager	Version 12.3 build123035
Zohocorp Manageengine Opmanager	Version 12.3 build123036
Zohocorp Manageengine Opmanager	Version 12.3 build123037
Zohocorp Manageengine Opmanager	Version 12.3 build123043
Zohocorp Manageengine Opmanager	Version 12.3 build123044
Zohocorp Manageengine Opmanager	Version 12.3 build123045
Zohocorp Manageengine Opmanager	Version 12.3 build123046
Zohocorp Manageengine Opmanager	Version 12.3 build123047
Zohocorp Manageengine Opmanager	Version 12.3 build123048
Zohocorp Manageengine Opmanager	Version 12.3 build123049
Zohocorp Manageengine Opmanager	Version 12.3 build123050
Zohocorp Manageengine Opmanager	Version 12.3 build123051
Zohocorp Manageengine Opmanager	Version 12.3 build123052
Zohocorp Manageengine Opmanager	Version 12.3 build123053
Zohocorp Manageengine Opmanager	Version 12.3 build123054
Zohocorp Manageengine Opmanager	Version 12.3 build123055
Zohocorp Manageengine Opmanager	Version 12.3 build123056
Zohocorp Manageengine Opmanager	Version 12.3 build123057
Zohocorp Manageengine Opmanager	Version 12.3 build123062
Zohocorp Manageengine Opmanager	Version 12.3 build123063
Zohocorp Manageengine Opmanager	Version 12.3 build123064
Zohocorp Manageengine Opmanager	Version 12.3 build123065
Zohocorp Manageengine Opmanager	Version 12.3 build123066
Zohocorp Manageengine Opmanager	Version 12.3 build123067
Zohocorp Manageengine Opmanager	Version 12.3 build123068
Zohocorp Manageengine Opmanager	Version 12.3 build123069
Zohocorp Manageengine Opmanager	Version 12.3 build123070
Zohocorp Manageengine Opmanager	Version 12.3 build123076
Zohocorp Manageengine Opmanager	Version 12.3 build123077
Zohocorp Manageengine Opmanager	Version 12.3 build123078
Zohocorp Manageengine Opmanager	Version 12.3 build123079
Zohocorp Manageengine Opmanager	Version 12.3 build123080
Zohocorp Manageengine Opmanager	Version 12.3 build123081
Zohocorp Manageengine Opmanager	Version 12.3 build123082
Zohocorp Manageengine Opmanager	Version 12.3 build123083
Zohocorp Manageengine Opmanager	Version 12.3 build123084
Zohocorp Manageengine Opmanager	Version 12.3 build123086
Zohocorp Manageengine Opmanager	Version 12.3 build123090
Zohocorp Manageengine Opmanager	Version 12.3 build123091
Zohocorp Manageengine Opmanager	Version 12.3 build123092
Zohocorp Manageengine Opmanager	Version 12.3 build123192
Zohocorp Manageengine Opmanager	Version 12.3 build123193
Zohocorp Manageengine Opmanager	Version 12.3 build123194
Zohocorp Manageengine Opmanager	Version 12.3 build123195
Zohocorp Manageengine Opmanager	Version 12.3 build123196
Zohocorp Manageengine Opmanager	Version 12.3 build123197
Zohocorp Manageengine Opmanager	Version 12.3 build123198
Zohocorp Manageengine Opmanager	Version 12.3 build123204
Zohocorp Manageengine Opmanager	Version 12.3 build123205
Zohocorp Manageengine Opmanager	Version 12.3 build123206
Zohocorp Manageengine Opmanager	Version 12.3 build123207
Zohocorp Manageengine Opmanager	Version 12.3 build123208
Zohocorp Manageengine Opmanager	Version 12.3 build123222
Zohocorp Manageengine Opmanager	Version 12.3 build123223
Zohocorp Manageengine Opmanager	Version 12.3 build123224
Zohocorp Manageengine Opmanager	Version 12.3 build123229
Zohocorp Manageengine Opmanager	Version 12.3 build123230
Zohocorp Manageengine Opmanager	Version 12.3 build123231
Zohocorp Manageengine Opmanager	Version 12.3 build123237

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (2)

https://www.manageengine.com/network-monitoring/help/read-me.html

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.manageengine.com/network-monitoring/help/read-me.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.