Access Control Flaw in Zoho ManageEngine Products
CVE-2018-12997

7.5HIGH

Key Information:

Vendor: Zohocorp
Status: Manageengine Netflow Analyzer; Firewall Analyzer; Manageengine Opmanager; Manageengine Oputils
Vendor: CVE Published:; 29 June 2018

What is CVE-2018-12997?

An improper access control vulnerability has been identified in the FailOverHelperServlet component of various Zoho ManageEngine products. This flaw enables attackers to read sensitive files on the web server without requiring authentication. By crafting a specific request, indicating the 'operation=copyfile' and unintentionally providing a valid 'fileName' substring, an unauthorized user may exploit this weakness, potentially exposing critical server data.