| Package | Affected versions | Patched versions |
|---|---|---|
| manageengine network configuration manager | < 12.3.214 | 12.3.214 |
| manageengine opmanager | < 12.3.214 | 12.3.214 |
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free