CVE-2019-17602

Published: Oct 15, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.

Affected (41)

Products: Zohocorp: Manageengine Opmanager

Zohocorp

1 product

Manageengine Opmanager

Configuration A

41 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Opmanager	Before 12.4
Zohocorp Manageengine Opmanager	Version 12.4
Zohocorp Manageengine Opmanager	Version 12.4 build124000
Zohocorp Manageengine Opmanager	Version 12.4 build124011
Zohocorp Manageengine Opmanager	Version 12.4 build124012
Zohocorp Manageengine Opmanager	Version 12.4 build124013
Zohocorp Manageengine Opmanager	Version 12.4 build124014
Zohocorp Manageengine Opmanager	Version 12.4 build124015
Zohocorp Manageengine Opmanager	Version 12.4 build124016
Zohocorp Manageengine Opmanager	Version 12.4 build124022
Zohocorp Manageengine Opmanager	Version 12.4 build124023
Zohocorp Manageengine Opmanager	Version 12.4 build124024
Zohocorp Manageengine Opmanager	Version 12.4 build124025
Zohocorp Manageengine Opmanager	Version 12.4 build124026
Zohocorp Manageengine Opmanager	Version 12.4 build124027
Zohocorp Manageengine Opmanager	Version 12.4 build124030
Zohocorp Manageengine Opmanager	Version 12.4 build124033
Zohocorp Manageengine Opmanager	Version 12.4 build124037
Zohocorp Manageengine Opmanager	Version 12.4 build124039
Zohocorp Manageengine Opmanager	Version 12.4 build124040
Zohocorp Manageengine Opmanager	Version 12.4 build124041
Zohocorp Manageengine Opmanager	Version 12.4 build124042
Zohocorp Manageengine Opmanager	Version 12.4 build124043
Zohocorp Manageengine Opmanager	Version 12.4 build124051
Zohocorp Manageengine Opmanager	Version 12.4 build124053
Zohocorp Manageengine Opmanager	Version 12.4 build124054
Zohocorp Manageengine Opmanager	Version 12.4 build124056
Zohocorp Manageengine Opmanager	Version 12.4 build124058
Zohocorp Manageengine Opmanager	Version 12.4 build124065
Zohocorp Manageengine Opmanager	Version 12.4 build124066
Zohocorp Manageengine Opmanager	Version 12.4 build124067
Zohocorp Manageengine Opmanager	Version 12.4 build124069
Zohocorp Manageengine Opmanager	Version 12.4 build124070
Zohocorp Manageengine Opmanager	Version 12.4 build124071
Zohocorp Manageengine Opmanager	Version 12.4 build124074
Zohocorp Manageengine Opmanager	Version 12.4 build124075
Zohocorp Manageengine Opmanager	Version 12.4 build124081
Zohocorp Manageengine Opmanager	Version 12.4 build124082
Zohocorp Manageengine Opmanager	Version 12.4 build124085
Zohocorp Manageengine Opmanager	Version 12.4 build124086
Zohocorp Manageengine Opmanager	Version 12.4 build124087

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (2)

https://www.manageengine.com/network-monitoring/help/read-me-complete.html

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.manageengine.com/network-monitoring/help/read-me-complete.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.