Lucene search

[email protected]CVE-2019-11677

HistoryMay 02, 2019 - 2:29 p.m.

CVE-2019-11677

2019-05-0214:29:00

CWE-611

[email protected]

web.nvd.nist.gov

cve-2019-11677

zoho manageengine

firewall analyzer

xxe injection

vulnerability

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

82.2%

JSON

The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.

Affected configurations

NVD

Node

zohocorpmanageengine_firewall_analyzerMatch7.27020

zohocorpmanageengine_firewall_analyzerMatch7.27021

zohocorpmanageengine_firewall_analyzerMatch7.47400

zohocorpmanageengine_firewall_analyzerMatch7.67600

zohocorpmanageengine_firewall_analyzerMatch8.08000

zohocorpmanageengine_firewall_analyzerMatch8.18110

zohocorpmanageengine_firewall_analyzerMatch8.38300

zohocorpmanageengine_firewall_analyzerMatch8.58500

zohocorpmanageengine_firewall_analyzerMatch12.012000

zohocorpmanageengine_firewall_analyzerMatch12.212200

zohocorpmanageengine_firewall_analyzerMatch12.312300

zohocorpmanageengine_firewall_analyzerMatch12.3123008

zohocorpmanageengine_firewall_analyzerMatch12.3123027

zohocorpmanageengine_firewall_analyzerMatch12.3123045

zohocorpmanageengine_firewall_analyzerMatch12.3123057

zohocorpmanageengine_firewall_analyzerMatch12.3123064

zohocorpmanageengine_firewall_analyzerMatch12.3123070

zohocorpmanageengine_firewall_analyzerMatch12.3123083

zohocorpmanageengine_firewall_analyzerMatch12.3123092

zohocorpmanageengine_firewall_analyzerMatch12.3123126

zohocorpmanageengine_firewall_analyzerMatch12.3123129

zohocorpmanageengine_firewall_analyzerMatch12.3123137

zohocorpmanageengine_firewall_analyzerMatch12.3123151

zohocorpmanageengine_firewall_analyzerMatch12.3123156

zohocorpmanageengine_firewall_analyzerMatch12.3123164

zohocorpmanageengine_firewall_analyzerMatch12.3123169

zohocorpmanageengine_firewall_analyzerMatch12.3123177

zohocorpmanageengine_firewall_analyzerMatch12.3123182

zohocorpmanageengine_firewall_analyzerMatch12.3123185

zohocorpmanageengine_firewall_analyzerMatch12.3123186

zohocorpmanageengine_firewall_analyzerMatch12.3123194

zohocorpmanageengine_firewall_analyzerMatch12.3123197

zohocorpmanageengine_firewall_analyzerMatch12.3123208

zohocorpmanageengine_firewall_analyzerMatch12.3123218

zohocorpmanageengine_firewall_analyzerMatch12.3123222

zohocorpmanageengine_firewall_analyzerMatch12.3123223

CPENameOperatorVersion
zohocorp:manageengine_firewall_analyzerzohocorp manageengine firewall analyzereq7.2
zohocorp:manageengine_firewall_analyzerzohocorp manageengine firewall analyzereq7.4
zohocorp:manageengine_firewall_analyzerzohocorp manageengine firewall analyzereq7.6
zohocorp:manageengine_firewall_analyzerzohocorp manageengine firewall analyzereq8.0
zohocorp:manageengine_firewall_analyzerzohocorp manageengine firewall analyzereq8.1
zohocorp:manageengine_firewall_analyzerzohocorp manageengine firewall analyzereq8.3
zohocorp:manageengine_firewall_analyzerzohocorp manageengine firewall analyzereq8.5
zohocorp:manageengine_firewall_analyzerzohocorp manageengine firewall analyzereq12.0
zohocorp:manageengine_firewall_analyzerzohocorp manageengine firewall analyzereq12.2
zohocorp:manageengine_firewall_analyzerzohocorp manageengine firewall analyzereq12.3

CPE	Name	Operator	Version
zohocorp:manageengine_firewall_analyzer	zohocorp manageengine firewall analyzer	eq	7.2
zohocorp:manageengine_firewall_analyzer	zohocorp manageengine firewall analyzer	eq	7.4
zohocorp:manageengine_firewall_analyzer	zohocorp manageengine firewall analyzer	eq	7.6
zohocorp:manageengine_firewall_analyzer	zohocorp manageengine firewall analyzer	eq	8.0
zohocorp:manageengine_firewall_analyzer	zohocorp manageengine firewall analyzer	eq	8.1
zohocorp:manageengine_firewall_analyzer	zohocorp manageengine firewall analyzer	eq	8.3
zohocorp:manageengine_firewall_analyzer	zohocorp manageengine firewall analyzer	eq	8.5
zohocorp:manageengine_firewall_analyzer	zohocorp manageengine firewall analyzer	eq	12.0
zohocorp:manageengine_firewall_analyzer	zohocorp manageengine firewall analyzer	eq	12.2
zohocorp:manageengine_firewall_analyzer	zohocorp manageengine firewall analyzer	eq	12.3

References

www.manageengine.com/products/firewall/release-notes.html

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

82.2%

JSON

Related for CVE-2019-11677

nvd1 prion1 cvelist1