High severity · published Jul 29, 2024
CVE-2024-6748
SQL Injection
8.3
CVSS
23.8%
EPSS
No
On KEV
Description
Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL monitoring.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)23.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpManager · ManageEngine
through 128317 · source: vendor
MO
Manageengine Opmanager · Zohocorp
through 128317 · source: CISA
MO
Manageengine Opmanager Msp · Zohocorp
through 128317 · source: CISA
MO
Manageengine Opmanager Plus · Zohocorp
through 128317 · source: CISA
MO
Manageengine Opmanager Rmm · Zohocorp
through 128317 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6748
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6748
www.manageengine.com
https://www.manageengine.com/itom/advisory/cve-2024-6748.html
More from OpManager
8.6
CVE-2023-47211
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258
6.1
CVE-2020-19554
Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload
4.3
CVE-2025-41437
Reflected XSS
–
CVE-2007-5891
Multiple cross-site scripting (XSS) vulnerabilities in jsp/Login.do in ManageEngine OpManager MSP Edition and OpManager 7.0 allow remote attackers to inject arbitrary web script…