Read the docs
TI-2019-08741 Aliases CVE-2019-11677GHSA-cww6-6g24-2wx4

The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3…

Priority MEDIUM 54CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.

Why it matters now

EPSS 0.09358 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:7.2:7020:*:*:*:*:*:*7.2 7020VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:7.2:7021:*:*:*:*:*:*7.2 7021VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:7.4:7400:*:*:*:*:*:*7.4 7400VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:7.6:7600:*:*:*:*:*:*7.6 7600VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:8.0:8000:*:*:*:*:*:*8.0 8000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:8.1:8110:*:*:*:*:*:*8.1 8110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:8.3:8300:*:*:*:*:*:*8.3 8300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:8.5:8500:*:*:*:*:*:*8.5 8500VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.0:12000:*:*:*:*:*:*12.0 12000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.2:12200:*:*:*:*:*:*12.2 12200VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:7.2:7020:*:*:*:*:*:* Versions 7.2 7020 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:7.2:7021:*:*:*:*:*:* Versions 7.2 7021 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:7.4:7400:*:*:*:*:*:* Versions 7.4 7400 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:7.6:7600:*:*:*:*:*:* Versions 7.6 7600 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:8.0:8000:*:*:*:*:*:* Versions 8.0 8000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:8.1:8110:*:*:*:*:*:* Versions 8.1 8110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:8.3:8300:*:*:*:*:*:* Versions 8.3 8300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:8.5:8500:*:*:*:*:*:* Versions 8.5 8500 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.0:12000:*:*:*:*:*:* Versions 12.0 12000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.2:12200:*:*:*:*:*:* Versions 12.2 12200 Vulnerable ·Zohocorp
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:12300:*:*:*:*:*:*12.3 12300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123008:*:*:*:*:*:*12.3 123008VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123027:*:*:*:*:*:*12.3 123027VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123045:*:*:*:*:*:*12.3 123045VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123057:*:*:*:*:*:*12.3 123057VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123064:*:*:*:*:*:*12.3 123064VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123070:*:*:*:*:*:*12.3 123070VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123083:*:*:*:*:*:*12.3 123083VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123092:*:*:*:*:*:*12.3 123092VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123126:*:*:*:*:*:*12.3 123126VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123129:*:*:*:*:*:*12.3 123129VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123137:*:*:*:*:*:*12.3 123137VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123151:*:*:*:*:*:*12.3 123151VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123156:*:*:*:*:*:*12.3 123156VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123164:*:*:*:*:*:*12.3 123164VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123169:*:*:*:*:*:*12.3 123169VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123177:*:*:*:*:*:*12.3 123177VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123182:*:*:*:*:*:*12.3 123182VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123185:*:*:*:*:*:*12.3 123185VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123186:*:*:*:*:*:*12.3 123186VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123194:*:*:*:*:*:*12.3 123194VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123197:*:*:*:*:*:*12.3 123197VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123208:*:*:*:*:*:*12.3 123208VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123218:*:*:*:*:*:*12.3 123218VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123222:*:*:*:*:*:*12.3 123222VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123223:*:*:*:*:*:*12.3 123223VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:12300:*:*:*:*:*:* Versions 12.3 12300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123008:*:*:*:*:*:* Versions 12.3 123008 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123027:*:*:*:*:*:* Versions 12.3 123027 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123045:*:*:*:*:*:* Versions 12.3 123045 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123057:*:*:*:*:*:* Versions 12.3 123057 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123064:*:*:*:*:*:* Versions 12.3 123064 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123070:*:*:*:*:*:* Versions 12.3 123070 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123083:*:*:*:*:*:* Versions 12.3 123083 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123092:*:*:*:*:*:* Versions 12.3 123092 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123126:*:*:*:*:*:* Versions 12.3 123126 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123129:*:*:*:*:*:* Versions 12.3 123129 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123137:*:*:*:*:*:* Versions 12.3 123137 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123151:*:*:*:*:*:* Versions 12.3 123151 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123156:*:*:*:*:*:* Versions 12.3 123156 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123164:*:*:*:*:*:* Versions 12.3 123164 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123169:*:*:*:*:*:* Versions 12.3 123169 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123177:*:*:*:*:*:* Versions 12.3 123177 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123182:*:*:*:*:*:* Versions 12.3 123182 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123185:*:*:*:*:*:* Versions 12.3 123185 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123186:*:*:*:*:*:* Versions 12.3 123186 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123194:*:*:*:*:*:* Versions 12.3 123194 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123197:*:*:*:*:*:* Versions 12.3 123197 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123208:*:*:*:*:*:* Versions 12.3 123208 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123218:*:*:*:*:*:* Versions 12.3 123218 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123222:*:*:*:*:*:* Versions 12.3 123222 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.3:123223:*:*:*:*:*:* Versions 12.3 123223 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11677
  2. 2026-10-03 Alias added: GHSA-cww6-6g24-2wx4

References

Advisory 1

  • TI-2022-17228 Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration… CVSS 3.1HIGH 8.8
  • TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
  • TI-2019-08742 The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build… CVSS 3.0CRITICAL 9.8
  • TI-2017-10286 Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability… CVSS 3.1HIGH 8.8
  • TI-2022-17138 Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration… CVSS 3.1HIGH 7.5
  • TI-2015-06460 ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions. CVSS 3.0HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences