PT-2019-7894
CVE-2017-11559
·
تاريخ النشر
2019-05-23
·
تاريخ التحديث
2019-05-24
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
ZOHO ManageEngine OpManager version 12.2
Description
An issue was discovered in the software, where the
apiKey parameter of the API endpoints "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack.Recommendations
For ZOHO ManageEngine OpManager version 12.2, consider restricting access to the vulnerable API endpoints "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" to minimize the risk of exploitation, and avoid using the
apiKey parameter in these endpoints until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾