CVE-2018-12997 Missing authorization in n/a
Attackers can read arbitrary files on the web server without authentication by sending a crafted request to the FailOverHelperServlet.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-12997?
CVE-2018-12997 is a high-severity missing authorization vulnerability in Zohocorp Manageengine Opmanager, published on 29 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.
Weakness: CWE-200
Which versions are affected by CVE-2018-12997?
It affects 5 products.
Products include Zohocorp Firewall Analyzer, Zohocorp Manageengine Netflow Analyzer, Zohocorp Manageengine Network Configuration Manager, Zohocorp Manageengine Opmanager, Zohocorp Manageengine Oputils.
How do I fix CVE-2018-12997?
No fix has been published for CVE-2018-12997 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-12997 being exploited?
There is no known exploitation of CVE-2018-12997 in the wild and no public exploit code.
Other vulnerabilities in Zohocorp Manageengine Opmanager
Sources
Also known as GHSA-658p-hh5r-7qvp.