CVE-2018-18980

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-11-06 04:29

Updated : 2023-12-10 12:44


NVD link : CVE-2018-18980

Mitre link : CVE-2018-18980

CVE.ORG link : CVE-2018-18980


JSON object : View

Products Affected

zohocorp

  • manageengine_opmanager
  • manageengine_network_configuration_manager
CWE
CWE-611

Improper Restriction of XML External Entity Reference