Xxe

2022-08-1520:15:00

PRIOn knowledge base

www.prio-n.com

zoho

oob-xxe

vulnerability

analytics plus

xml

remote attackers

arbitrary files

enumerate folders

scan internal ports.

7.5 High

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

83.1%

JSON

Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file.

CPENameOperatorVersion
manageengine_analytics_pluslt4.3.5

CPE	Name	Operator	Version
	manageengine_analytics_plus	lt	4.3.5

References

www.manageengine.com/analytics-plus/release-notes.html