9.8

CVE-2018-20173

Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild12300
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123001
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123002
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123003
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123004
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123005
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123006
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123007
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123008
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123009
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123010
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123011
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123012
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123013
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123014
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123015
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123021
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123022
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123023
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123024
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123025
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123026
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123027
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123028
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123029
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123030
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123031
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123032
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123033
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123034
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123035
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123036
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123037
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123043
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123044
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123045
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123046
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123047
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123048
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123049
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123050
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123051
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123052
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123053
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123054
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123055
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123056
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123057
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123062
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123063
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123064
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123065
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123066
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123067
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123068
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123069
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123070
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123076
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123077
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123078
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123079
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123080
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123081
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123082
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123083
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123084
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123086
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123090
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123091
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123092
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123192
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123193
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123194
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123195
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123196
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123197
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123198
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123204
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123205
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123206
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123207
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123208
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123222
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123223
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123224
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123229
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123230
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123231
Zohocorp ≫ Manageengine Opmanager Version12.3 Updatebuild123237
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 12.83% 0.937
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.