8.6

CVE-2023-47211

Exploit
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.7 Update build127000
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.7 Update build127101
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.7 Update build127130
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.7 Update build127131
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.7 Update build127187
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.7 Update build127244
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.7 Update build127257
Zohocorp ≫ Manageengine Firewall Analyzer Version 12.7 Update build127259
Zohocorp ≫ Manageengine Netflow Analyzer Version 12.7 Update build127000
Zohocorp ≫ Manageengine Netflow Analyzer Version 12.7 Update build127003
Zohocorp ≫ Manageengine Netflow Analyzer Version 12.7 Update build127101
Zohocorp ≫ Manageengine Netflow Analyzer Version 12.7 Update build127130
Zohocorp ≫ Manageengine Netflow Analyzer Version 12.7 Update build127131
Zohocorp ≫ Manageengine Netflow Analyzer Version 12.7 Update build127187
Zohocorp ≫ Manageengine Netflow Analyzer Version 12.7 Update build127244
Zohocorp ≫ Manageengine Netflow Analyzer Version 12.7 Update build127255
Zohocorp ≫ Manageengine Netflow Analyzer Version 12.7 Update build127257
Zohocorp ≫ Manageengine Netflow Analyzer Version 12.7 Update build127259
Zohocorp ≫ Manageengine Network Configuration Manager Version 12.7 Update build127000
Zohocorp ≫ Manageengine Network Configuration Manager Version 12.7 Update build127102
Zohocorp ≫ Manageengine Network Configuration Manager Version 12.7 Update build127105
Zohocorp ≫ Manageengine Network Configuration Manager Version 12.7 Update build127132
Zohocorp ≫ Manageengine Network Configuration Manager Version 12.7 Update build127243
Zohocorp ≫ Manageengine Network Configuration Manager Version 12.7 Update build127257
Zohocorp ≫ Manageengine Network Configuration Manager Version 12.7 Update build127259
Zohocorp ≫ Manageengine Opmanager Version < 12.7
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127000
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127001
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127002
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127003
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127004
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127100
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127101
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127102
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127103
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127104
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127109
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127116
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127117
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127118
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127119
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127120
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127122
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127123
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127131
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127133
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127134
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127136
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127138
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127140
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127141
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127185
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127186
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127187
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127188
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127189
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127191
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127240
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127241
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127242
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127243
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127255
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127256
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127257
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127258
Zohocorp ≫ Manageengine Opmanager Version 12.7 Update build127259
Zohocorp ≫ Manageengine Opmanager Msp Version 12.7 Update build127109
Zohocorp ≫ Manageengine Opmanager Msp Version 12.7 Update build127122
Zohocorp ≫ Manageengine Opmanager Msp Version 12.7 Update build127123
Zohocorp ≫ Manageengine Opmanager Msp Version 12.7 Update build127138
Zohocorp ≫ Manageengine Opmanager Msp Version 12.7 Update build127139
Zohocorp ≫ Manageengine Opmanager Msp Version 12.7 Update build127140
Zohocorp ≫ Manageengine Opmanager Msp Version 12.7 Update build127141
Zohocorp ≫ Manageengine Opmanager Msp Version 12.7 Update build127142
Zohocorp ≫ Manageengine Opmanager Msp Version 12.7 Update build127259
Zohocorp ≫ Manageengine Opmanager Plus Version 12.7 Update build127109
Zohocorp ≫ Manageengine Opmanager Plus Version 12.7 Update build127122
Zohocorp ≫ Manageengine Opmanager Plus Version 12.7 Update build127123
Zohocorp ≫ Manageengine Opmanager Plus Version 12.7 Update build127138
Zohocorp ≫ Manageengine Opmanager Plus Version 12.7 Update build127139
Zohocorp ≫ Manageengine Opmanager Plus Version 12.7 Update build127140
Zohocorp ≫ Manageengine Opmanager Plus Version 12.7 Update build127141
Zohocorp ≫ Manageengine Opmanager Plus Version 12.7 Update build127142
Zohocorp ≫ Manageengine Opmanager Plus Version 12.7 Update build127259
Zohocorp ≫ Manageengine Oputils Version < 12.7
Zohocorp ≫ Manageengine Oputils Version 12.7 Update build127101
Zohocorp ≫ Manageengine Oputils Version 12.7 Update build127117
Zohocorp ≫ Manageengine Oputils Version 12.7 Update build127134
Zohocorp ≫ Manageengine Oputils Version 12.7 Update build127241
Zohocorp ≫ Manageengine Oputils Version 12.7 Update build127242
Zohocorp ≫ Manageengine Oputils Version 12.7 Update build127258
Zohocorp ≫ Manageengine Oputils Version 12.7 Update build127259
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 47.02% 0.987
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.6 3.9 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Cisco Talos 9.1 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1851
Third Party Advisory
Exploit
https://www.manageengine.com/itom/advisory/cve-2023-47211.html
Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1851