CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a…

published September 21, 2018

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.3th percentile for exploit probability.

CVSS
—
EPSS
66%
Percentile
99.3
In the wild
Unconfirmed
What it is

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.66347 · 99.3th percentile
Published
2018-09-21T03:00Z
EPSS history
Timeline
  • 22 SEP 03:15Z
    EPSS moved 66% → 46%
    epss
  • 06 SEP 03:11Z
    EPSS moved 66% → 46%
    epss
  • 30 AUG 16:00Z
    EPSS moved 46% → 66%
    epss
  • 29 AUG 04:35Z
    EPSS moved 66% → 46%
    epss
  • 21 SEP 03:00Z
    Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a…
    cvelistv5