Vulnerabilities > CVE-2018-18980 - XXE vulnerability in Zohocorp Manageengine Network Configuration Manager

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

zohocorp

CWE-611

NVD

Published: 2018-11-06

Updated: 2019-01-30

Summary

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

Vulnerable Configurations

Part	Description	Count
Application	Zohocorp Zohocorp Manageengine Network Configuration Manager - Zohocorp Manageengine Network Configuration Manager 11.0 Zohocorp Manageengine Network Configuration Manager 12.0 Zohocorp Manageengine Network Configuration Manager 12.1 Zohocorp Manageengine Network Configuration Manager 12.2 Zohocorp Manageengine Network Configuration Manager 12.3 Zohocorp Manageengine Network Configuration Manager 12.3.055 Zohocorp Manageengine Opmanager - Zohocorp Manageengine Opmanager 8 Zohocorp Manageengine Opmanager 11.4 Zohocorp Manageengine Opmanager 11.5 Zohocorp Manageengine Opmanager 12.2 Zohocorp Manageengine Opmanager 12.3	449

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References