high7.5
CVE-2018-18980
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML…
Impact
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Network Configuration Manager | before 12.3.214 |
| Zohocorp | Manageengine Opmanager | before 12.3.214 |