Lucene search

[email protected]CVE-2018-18949

HistoryNov 05, 2018 - 9:29 a.m.

CVE-2018-18949

2018-11-0509:29:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2018-18949

zoho

manageengine

opmanager

sql injection

mail server settings

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.028 Low

EPSS

Percentile

90.7%

JSON

Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.

CPENameOperatorVersion
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq11.5
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq11.4
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq12.3

CPE	Name	Operator	Version
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	11.5
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	11.4
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	12.3

References

www.manageengine.com/network-monitoring/help/read-me.html

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.028 Low

EPSS

Percentile

90.7%

JSON

Related for CVE-2018-18949

prion1 checkpoint_advisories1 cvelist1