9.8

CVE-2021-40493

Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Opmanager Version < 12.5
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update -
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125000
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125002
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125100
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125101
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125102
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125108
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125110
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125111
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125112
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125113
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125114
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125116
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125117
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125118
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125120
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125121
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125123
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125124
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125125
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125136
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125137
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125139
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125140
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125143
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125144
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125145
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125156
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125157
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125158
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125159
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125161
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125163
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125174
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125175
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125176
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125177
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125178
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125180
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125181
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125192
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125193
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125194
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125195
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125196
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125197
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125198
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125201
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125204
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125212
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125213
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125214
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125215
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125216
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125228
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125229
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125230
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125231
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125232
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125233
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125312
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125323
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125324
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125326
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125328
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125329
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125340
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125341
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125342
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125343
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125344
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125346
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125358
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125359
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125360
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125361
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125362
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125364
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125366
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125367
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125375
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125376
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125377
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125378
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125379
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125380
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125381
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125382
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125386
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125392
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125393
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125394
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125397
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125398
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125399
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125405
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125410
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125411
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125413
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125414
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125415
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125416
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125417
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125420
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125428
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125430
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125431
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125432
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125433
Zohocorp ≫ Manageengine Opmanager Version 12.5 Update build125434
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 50.21% 0.988
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

https://www.manageengine.com/network-monitoring/security-updates/cve-2021-40493.html
Vendor Advisory