Critical severity · published Oct 15, 2019
CVE-2019-17602
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089
9.8
CVSS
81.1%
EPSS
No
On KEV
Description
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)81.1% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Manageengine Opmanager · Zohocorp
before 12.4; 12.4; 12.4; 12.4; 12.4; 12.4; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17602
Release Notes
https://www.manageengine.com/network-monitoring/help/read-me-complete.html
More from Manageengine Opmanager
9.9
CVE-2026-19599
Remote Code Execution vulnerability
9.8
CVE-2022-29535
Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports
9.8
CVE-2021-44514
OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories
9.8
CVE-2021-41075
The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API
9.8
CVE-2021-40493
Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module