PT-2024-1784 · Zoho · Manageengine Opmanager

Icewall

+2

·

Published

2024-01-08

·

Updated

2024-02-07

·

CVE-2023-47211

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Name of the Vulnerable Software and Affected Versions ManageEngine OpManager version 12.7.258
Description A directory traversal vulnerability exists in the uploadMib functionality, allowing an attacker to send a malicious MiB file and trigger the vulnerability, potentially leading to arbitrary file creation. This issue is related to incorrect restriction of a directory path name with limited access. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary code. Approximately 6,971 devices are potentially affected, mainly distributed in China and the United States.
Recommendations For ManageEngine OpManager version 12.7.258, consider disabling the uploadMib functionality until a patch is available to prevent exploitation. Restrict access to the uploadMib feature to minimize the risk of arbitrary file creation. Avoid using the uploadMib functionality with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-01516
CVE-2023-47211

Affected Products

Manageengine Opmanager