Sign-up

ID

VAR-201905-0977


CVE

CVE-2019-11677


TITLE

Zoho ManageEngine Firewall Analyzer In XML External entity vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2019-004015

DESCRIPTION

The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection. Zoho ManageEngine Firewall Analyzer is prone to the following security vulnerabilities. 1. An HTML-injection vulnerability. 2. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or gain access to sensitive information or cause denial-of-service conditions. Other attacks are also possible. ZOHO ManageEngine Firewall Analyzer is a set of web-based firewall log analysis tools from ZOHO, USA. It can collect, correlate analysis and report logs on firewalls, proxy servers and Radius servers throughout the enterprise. This vulnerability stems from improper design or implementation problems in the code development process of network systems or products

Trust: 2.07

sources: NVD: CVE-2019-11677 // JVNDB: JVNDB-2019-004015 // BID: 108841 // VULHUB: VHN-143347 // VULMON: CVE-2019-11677

AFFECTED PRODUCTS

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:7.4

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:8.5

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:8.1

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:8.3

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:12.0

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:12.2

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:7.6

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:12.3

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:7.2

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:8.0

Trust: 1.0

vendor:zohomodel:manageengine firewall analyzerscope:ltversion:12.3 build 123224

Trust: 0.8

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:8.58500

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:8.38300

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:8.18110

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:8.08000

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:7.67600

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:7.47400

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:7.27021

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:7.27020

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123223

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123222

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123218

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123208

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123197

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123194

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123186

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123185

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123182

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123177

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123169

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123164

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123156

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123151

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123137

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123129

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123126

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123092

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123083

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123070

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123064

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123057

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123045

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123027

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123008

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.312300

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.212200

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.012000

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:neversion:12.3123224

Trust: 0.3

sources: BID: 108841 // JVNDB: JVNDB-2019-004015 // NVD: CVE-2019-11677

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-11677
value: CRITICAL

Trust: 1.0

NVD: CVE-2019-11677
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201905-070
value: CRITICAL

Trust: 0.6

VULHUB: VHN-143347
value: HIGH

Trust: 0.1

VULMON: CVE-2019-11677
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-11677
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-143347
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-11677
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-143347 // VULMON: CVE-2019-11677 // JVNDB: JVNDB-2019-004015 // CNNVD: CNNVD-201905-070 // NVD: CVE-2019-11677

PROBLEMTYPE DATA

problemtype:CWE-611

Trust: 1.9

sources: VULHUB: VHN-143347 // JVNDB: JVNDB-2019-004015 // NVD: CVE-2019-11677

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201905-070

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-201905-070

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-004015

PATCH
title:Firewall Analyzer - Release Notesurl:https://www.manageengine.com/products/firewall/release-notes.html
Trust: 0.8
title:ZOHO ManageEngine Firewall Analyzer Fixes for code issue vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=92209
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-004015 // 
            
            
            
            CNNVD: CNNVD-201905-070

EXTERNAL IDS
db:NVDid:CVE-2019-11677
Trust: 2.9
db:JVNDBid:JVNDB-2019-004015
Trust: 0.8
db:CNNVDid:CNNVD-201905-070
Trust: 0.7
db:BIDid:108841
Trust: 0.3
db:VULHUBid:VHN-143347
Trust: 0.1
db:VULMONid:CVE-2019-11677
Trust: 0.1
sources:
            
            
            VULHUB: VHN-143347 // 
            
            
            
            VULMON: CVE-2019-11677 // 
            
            
            
            BID: 108841 // 
            
            
            
            JVNDB: JVNDB-2019-004015 // 
            
            
            
            CNNVD: CNNVD-201905-070 // 
            
            
            
            NVD: CVE-2019-11677

REFERENCES
url:https://www.manageengine.com/products/firewall/release-notes.html
Trust: 2.1
url:https://nvd.nist.gov/vuln/detail/cve-2019-11677
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11677
Trust: 0.8
url:https://www.manageengine.com/products/firewall/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/611.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-143347 // 
            
            
            
            VULMON: CVE-2019-11677 // 
            
            
            
            BID: 108841 // 
            
            
            
            JVNDB: JVNDB-2019-004015 // 
            
            
            
            CNNVD: CNNVD-201905-070 // 
            
            
            
            NVD: CVE-2019-11677

CREDITS
The vendor reported these issues.
Trust: 0.3
sources:
            
            
            BID: 108841

SOURCES
db:VULHUBid:VHN-143347
db:VULMONid:CVE-2019-11677
db:BIDid:108841
db:JVNDBid:JVNDB-2019-004015
db:CNNVDid:CNNVD-201905-070
db:NVDid:CVE-2019-11677

LAST UPDATE DATE
2024-11-23T22:21:37.213000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-143347date:2019-05-03T00:00:00
db:VULMONid:CVE-2019-11677date:2019-05-03T00:00:00
db:BIDid:108841date:2019-05-02T00:00:00
db:JVNDBid:JVNDB-2019-004015date:2019-05-27T00:00:00
db:CNNVDid:CNNVD-201905-070date:2019-05-08T00:00:00
db:NVDid:CVE-2019-11677date:2024-11-21T04:21:34.457

SOURCES RELEASE DATE
db:VULHUBid:VHN-143347date:2019-05-02T00:00:00
db:VULMONid:CVE-2019-11677date:2019-05-02T00:00:00
db:BIDid:108841date:2019-05-02T00:00:00
db:JVNDBid:JVNDB-2019-004015date:2019-05-27T00:00:00
db:CNNVDid:CNNVD-201905-070date:2019-05-02T00:00:00
db:NVDid:CVE-2019-11677date:2019-05-02T14:29:00.387