PT-2018-13972 · Zoho · Zoho Manageengine Opmanager

Publicado 2018-09-21 · Atualizado 2018-12-03 · CVE-2018-17283

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.3 Build 123196

Description The issue allows unauthorized access to certain API endpoints without requiring authentication. Specifically, the /oputilsServlet endpoint can be exploited to obtain an API key. This can be further leveraged to add an admin user via the /api/json/v2/admin/addUser endpoint or to conduct a SQL Injection attack by manipulating the name parameter in the /api/json/device/setManaged endpoint.

Recommendations For versions prior to 12.3 Build 123196, update to version 12.3 Build 123196 or later to resolve the issue. As a temporary workaround, consider restricting access to the /oputilsServlet endpoint and the /api/json/v2/admin/addUser and /api/json/device/setManaged endpoints to minimize the risk of exploitation. Avoid using the name parameter in the /api/json/device/setManaged endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-17283

Produtos afetados

Zoho Manageengine Opmanager

Referências · 4

• 🔥 https://github.com/x-f1v3/ForCve/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2018-17283 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17283 · Nota de Segurança
• https://manageengine.com/network-monitoring/help/read-me.html · Aviso do Fabricante