9.8

CVE-2019-11677

The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Firewall Analyzer Version 7.2 Update 7020
Zohocorp ≫ Manageengine Firewall Analyzer Version 7.2 Update 7021
Zohocorp ≫ Manageengine Firewall Analyzer Version 7.4 Update 7400
Zohocorp ≫ Manageengine Firewall Analyzer Version 7.6 Update 7600
Zohocorp ≫ Manageengine Firewall Analyzer Version 8.0 Update 8000
Zohocorp ≫ Manageengine Firewall Analyzer Version 8.1 Update 8110
Zohocorp ≫ Manageengine Firewall Analyzer Version 8.3 Update 8300
Zohocorp ≫ Manageengine Firewall Analyzer Version 8.5 Update 8500
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.0 Update 12000
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.2 Update 12200
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 12300
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123008
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123027
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123045
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123057
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123064
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123070
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123083
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123092
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123126
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123129
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123137
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123151
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123156
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123164
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123169
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123177
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123182
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123185
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123186
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123194
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123197
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123208
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123218
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123222
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.3 Update 123223
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 9.36% 0.948
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://www.manageengine.com/products/firewall/release-notes.html
Vendor Advisory
Release Notes