Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2018-17243: Zoho ManageEngine OpManager search lets attackers inject code
CVE-2018-17243 · published 8 years ago
Summary
The Global Search feature in Zoho ManageEngine OpManager can be tricked into running malicious database commands. This could let an attacker view, change, or delete data stored by the system. Apply the latest software update or patch from Zoho to close the problem.
What to do
- Update zohocorp manageengine_opmanager to version 12.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zohocorp | manageengine_opmanager |
< 12.3 cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:* |
Original advisory text
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.
References
- https://www.manageengine.com/network-monitoring/help/read-me.html Release Notes Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published20 Sep 2018
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2018-17243 · NVD
Track software like this
Free during beta