CVE-2018-18980

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML…

published November 6, 2018

CVSS

—

EPSS

25%

Percentile

97.9

In the wild

Unconfirmed

What it is

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.24995 · 97.9th percentile
Published: 2018-11-06T04:00Z

EPSS history

Timeline

06 NOV 04:00Z
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML…
cvelistv5