CVE-2018-12997

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.

• CWE-200

• http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jul/73Mailing List, Third Party Advisory
• http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-037Exploit, Third Party Advisory
• https://github.com/unh3x/just4cve/issues/8Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jul/73Mailing List, Third Party Advisory
• http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-037Exploit, Third Party Advisory
• https://github.com/unh3x/just4cve/issues/8Exploit, Third Party Advisory

Published

Jun 29, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12990phpwcms 1.8.9 allows remote attackers to discover the instal…
• CVE-2018-12992An issue was discovered CMS MaeloStore V.1.5.0. There is sto…4.8
• CVE-2018-12993onefilecms.php in OneFileCMS through 2012-04-14 might allow …
• CVE-2018-12994onefilecms.php in OneFileCMS through 2012-04-14 might allow …
• CVE-2018-12995onefilecms.php in OneFileCMS through 2012-04-14 might allow …
• CVE-2018-12996A reflected Cross-site scripting (XSS) vulnerability in Zoho…
• CVE-2018-12998A reflected Cross-site scripting (XSS) vulnerability in Zoho…6.1
• CVE-2018-12999Incorrect Access Control in AgentTrayIconServlet in Zoho Man…
• CVE-2018-1300Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-13000An XSS issue was discovered in Advanced Electron Forum (AEF)…
• CVE-2018-13001An XSS issue was discovered in Sandoba CP:Shop v2016.1. The …
• CVE-2018-13002An XSS issue was discovered in Inhaltsprojekte in Weblicatio…