CVE-2024-10839

HIGH

ManageEngine SharePoint Manager Plus <= 4503 - Authenticated XML External Entity Injection in Management Option

Title source: llm

Description

Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.

References (1)

Core 1

Core References

Vendor Advisory

https://www.manageengine.com/sharepoint-management-reporting/advisory/CVE-2024-10839.html

Scores

CVSS v3 8.5

EPSS 0.0146

EPSS Percentile 70.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-611

Status published

Products (4)

zohocorp/manageengine_sharepoint_manager_plus 4.0 4000 (34 CPE variants)

zohocorp/manageengine_sharepoint_manager_plus 4.1 4100 (11 CPE variants)

zohocorp/manageengine_sharepoint_manager_plus 4.2 4200 (2 CPE variants)

zohocorp/manageengine_sharepoint_manager_plus 4.3 4300 (3 CPE variants)

Published Nov 08, 2024

Tracked Since Feb 18, 2026