Security Advisory

CVE-2018-18980

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2018-11-06 04:00:00

Last updated 2024-09-16 17:54:36

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

← Browse all CVEs View on cve.org ↗