PT-2018-13972 · Zoho · Zoho Manageengine Opmanager

Published 2018-09-21 · Updated 2018-12-03 · CVE-2018-17283

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.3 Build 123196

Description The issue allows unauthorized access to certain API endpoints without requiring authentication. Specifically, the /oputilsServlet endpoint can be exploited to obtain an API key. This can be further leveraged to add an admin user via the /api/json/v2/admin/addUser endpoint or to conduct a SQL Injection attack by manipulating the name parameter in the /api/json/device/setManaged endpoint.

Recommendations For versions prior to 12.3 Build 123196, update to version 12.3 Build 123196 or later to resolve the issue. As a temporary workaround, consider restricting access to the /oputilsServlet endpoint and the /api/json/v2/admin/addUser and /api/json/device/setManaged endpoints to minimize the risk of exploitation. Avoid using the name parameter in the /api/json/device/setManaged endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-17283

Affected Products

Zoho Manageengine Opmanager

References · 4

• 🔥 https://github.com/x-f1v3/ForCve/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2018-17283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17283 · Security Note
• https://manageengine.com/network-monitoring/help/read-me.html · Vendor Advisory