CVE-2018-18980

CWE-611 — XML External Entity (XXE)3 documents3 sources
Severity
7.5HIGH
EPSS
30.5%
top 3.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Zohocorp Manageengine Network Configuration ManagerZohocorp Manageengine Opmanager
Timeline
PublishedNov 6
Latest updateMay 14

Description

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-g7qq-6w8p-g7fm: An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12↗2022-05-14
▶
CVEList
CVE-2018-18980: An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12↗2018-11-06
▶
CVE-2018-18980 (HIGH CVSS 7.5) | An XML External Entity injection (X | cvebase.io