CVE-2018-12997
High
Description
Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.
SeverityHigh
CVSS7.5
Exploit probability—
ProductZohocorp Firewall Analyzer
PublishedJun 29, 2018
First seenJun 29, 2018
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zohocorp firewall_analyzer | No range specified | — |
| zohocorp manageengine_netflow_analyzer | No range specified | — |
| zohocorp manageengine_network_configuration_manager | No range specified | — |
| zohocorp manageengine_opmanager | No range specified | — |
| zohocorp manageengine_oputils | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.