ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2018-18980

PoC —
CVSS 3.0
7.5 high
EPSS
25%p98
Published
()
Modified
Description

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

Vendors
zohocorp
Products
manageengine network configuration manager, manageengine opmanager
Weakness
CWE-611
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD CVE.org GitHub PoCs EPSS (25.0%)

In the news

No ingested article mentions this CVE yet.