Read the docs
TI-2019-13137 Aliases CVE-2019-17602GHSA-c53x-hwmf-5w37

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089.

Priority HIGH 82CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.

Why it matters now

EPSS 0.8108 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 41

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*before 12.4VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:-:*:*:*:*:*:*12.4VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124000:*:*:*:*:*:*12.4 build124000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124011:*:*:*:*:*:*12.4 build124011VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124012:*:*:*:*:*:*12.4 build124012VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124013:*:*:*:*:*:*12.4 build124013VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124014:*:*:*:*:*:*12.4 build124014VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124015:*:*:*:*:*:*12.4 build124015VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124016:*:*:*:*:*:*12.4 build124016VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124022:*:*:*:*:*:*12.4 build124022VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:* Versions before 12.4 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:-:*:*:*:*:*:* Versions 12.4 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124000:*:*:*:*:*:* Versions 12.4 build124000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124011:*:*:*:*:*:* Versions 12.4 build124011 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124012:*:*:*:*:*:* Versions 12.4 build124012 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124013:*:*:*:*:*:* Versions 12.4 build124013 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124014:*:*:*:*:*:* Versions 12.4 build124014 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124015:*:*:*:*:*:* Versions 12.4 build124015 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124016:*:*:*:*:*:* Versions 12.4 build124016 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124022:*:*:*:*:*:* Versions 12.4 build124022 Vulnerable ·Zohocorp
Show 31 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124023:*:*:*:*:*:*12.4 build124023VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124024:*:*:*:*:*:*12.4 build124024VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124025:*:*:*:*:*:*12.4 build124025VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124026:*:*:*:*:*:*12.4 build124026VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124027:*:*:*:*:*:*12.4 build124027VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124030:*:*:*:*:*:*12.4 build124030VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124033:*:*:*:*:*:*12.4 build124033VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124037:*:*:*:*:*:*12.4 build124037VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124039:*:*:*:*:*:*12.4 build124039VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124040:*:*:*:*:*:*12.4 build124040VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124041:*:*:*:*:*:*12.4 build124041VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124042:*:*:*:*:*:*12.4 build124042VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124043:*:*:*:*:*:*12.4 build124043VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124051:*:*:*:*:*:*12.4 build124051VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124053:*:*:*:*:*:*12.4 build124053VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124054:*:*:*:*:*:*12.4 build124054VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124056:*:*:*:*:*:*12.4 build124056VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124058:*:*:*:*:*:*12.4 build124058VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124065:*:*:*:*:*:*12.4 build124065VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124066:*:*:*:*:*:*12.4 build124066VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124067:*:*:*:*:*:*12.4 build124067VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124069:*:*:*:*:*:*12.4 build124069VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124070:*:*:*:*:*:*12.4 build124070VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124071:*:*:*:*:*:*12.4 build124071VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124074:*:*:*:*:*:*12.4 build124074VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124075:*:*:*:*:*:*12.4 build124075VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124081:*:*:*:*:*:*12.4 build124081VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124082:*:*:*:*:*:*12.4 build124082VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124085:*:*:*:*:*:*12.4 build124085VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124086:*:*:*:*:*:*12.4 build124086VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124087:*:*:*:*:*:*12.4 build124087VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124023:*:*:*:*:*:* Versions 12.4 build124023 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124024:*:*:*:*:*:* Versions 12.4 build124024 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124025:*:*:*:*:*:* Versions 12.4 build124025 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124026:*:*:*:*:*:* Versions 12.4 build124026 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124027:*:*:*:*:*:* Versions 12.4 build124027 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124030:*:*:*:*:*:* Versions 12.4 build124030 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124033:*:*:*:*:*:* Versions 12.4 build124033 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124037:*:*:*:*:*:* Versions 12.4 build124037 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124039:*:*:*:*:*:* Versions 12.4 build124039 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124040:*:*:*:*:*:* Versions 12.4 build124040 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124041:*:*:*:*:*:* Versions 12.4 build124041 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124042:*:*:*:*:*:* Versions 12.4 build124042 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124043:*:*:*:*:*:* Versions 12.4 build124043 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124051:*:*:*:*:*:* Versions 12.4 build124051 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124053:*:*:*:*:*:* Versions 12.4 build124053 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124054:*:*:*:*:*:* Versions 12.4 build124054 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124056:*:*:*:*:*:* Versions 12.4 build124056 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124058:*:*:*:*:*:* Versions 12.4 build124058 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124065:*:*:*:*:*:* Versions 12.4 build124065 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124066:*:*:*:*:*:* Versions 12.4 build124066 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124067:*:*:*:*:*:* Versions 12.4 build124067 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124069:*:*:*:*:*:* Versions 12.4 build124069 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124070:*:*:*:*:*:* Versions 12.4 build124070 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124071:*:*:*:*:*:* Versions 12.4 build124071 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124074:*:*:*:*:*:* Versions 12.4 build124074 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124075:*:*:*:*:*:* Versions 12.4 build124075 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124081:*:*:*:*:*:* Versions 12.4 build124081 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124082:*:*:*:*:*:* Versions 12.4 build124082 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124085:*:*:*:*:*:* Versions 12.4 build124085 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124086:*:*:*:*:*:* Versions 12.4 build124086 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124087:*:*:*:*:*:* Versions 12.4 build124087 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-17602
  2. 2026-10-03 Alias added: GHSA-c53x-hwmf-5w37

References

Advisory 1

  • TI-2022-11994 Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. CVSS 3.1CRITICAL 9.8
  • TI-2021-18117 Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. CVSS 3.1CRITICAL 9.8
  • TI-2020-17379 Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233)… CVSS 3.1CRITICAL 9.8
  • TI-2023-14824 Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote… CVSS 3.1HIGH 8.8
  • TI-2018-12325 Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. CVSS 3.0CRITICAL 9.8
  • TI-2015-06446 PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote… CVSS 2.0HIGH 9.0
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences