What is CVE-2019-17602?

CVE-2019-17602 is a critical-severity vulnerability in Zohocorp Manageengine_opmanager, classified under SQL Injection. CVSS score: 9.8/10. Published 2019-10-15.

How severe is CVE-2019-17602?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2019-17602 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Zohocorp Manageengine_opmanager

CVE-2019-17602

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authen…

Vulnerability class: SQL Injection

EPSS: 0.815 (99.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Zohocorp Manageengine_opmanager — versions 12.4
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

References

cve@mitre.org (x_refsource_MISC, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2019-17602?: CVE-2019-17602 is a critical-severity vulnerability in Zohocorp Manageengine_opmanager, classified under SQL Injection. CVSS score: 9.8/10. Published 2019-10-15.
How severe is CVE-2019-17602?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2019-17602 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.