CVE-2019-11677

CRITICAL

Zoho ManageEngine Firewall Analyzer <12.3 Build 123224 - XXE Injection

Title source: llm

Description

The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.

References (1)

Core 1

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://www.manageengine.com/products/firewall/release-notes.html

Scores

CVSS v3 9.8

EPSS 0.0235

EPSS Percentile 85.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-611

Status published

Products (10)

zohocorp/manageengine_firewall_analyzer 7.2 7020 (2 CPE variants)

zohocorp/manageengine_firewall_analyzer 7.4 7400

zohocorp/manageengine_firewall_analyzer 7.6 7600

zohocorp/manageengine_firewall_analyzer 8.0 8000

zohocorp/manageengine_firewall_analyzer 8.1 8110

zohocorp/manageengine_firewall_analyzer 8.3 8300

zohocorp/manageengine_firewall_analyzer 8.5 8500

zohocorp/manageengine_firewall_analyzer 12.0 12000

zohocorp/manageengine_firewall_analyzer 12.2 12200

zohocorp/manageengine_firewall_analyzer 12.3 12300 (26 CPE variants)

Published May 02, 2019

Tracked Since Feb 18, 2026