VulnerabilityModified
CVE-2019-17602
The OPMDeviceDetailsServlet servlet is prone to SQL injection.
CRITICAL 9.8EPSS 81.5%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 81.5%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 81.55% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- zohocorp/manageengine opmanager
- Source
- cve@mitre.org
References
- https://www.manageengine.com/network-monitoring/help/read-me-complete.htmlRelease Notes, Vendor Advisory
- https://www.manageengine.com/network-monitoring/help/read-me-complete.htmlRelease Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.