CVEsManageEngineCVE-2024-10839Published Nov 8, 2024, 10:58 · Updated Nov 8, 2024, 14:18 UTC
8.5
HighCVSS 3.1 · from ManageEngine
CVE-2024-10839

XML External Entity

SharePoint Manager Plus · XML external entities · CWE-611
AffectedSharePoint Manager Plus
FixNo fix listed yet.
PublishedNov 8, 2024, 10:58 · ManageEngine
ScoredNov 8, 2024 · 8.5 · ManageEngine
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC

What we know

No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read data. CVSS impact.

Description

Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.

From ManageEngine

Affected and fixed versions

ProductAffectedFixed inSharePoint Manager Plusup to 4503–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

www.manageengine.com/sharepoint-management-reporting/advisory/CVE-2024-10839.html · manageengine.com

Other CVEs in SharePoint Manager Plus

All 2 →
7.9Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus · CVE-2026-119682Oct 308.5Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature · CVE-2026-119680Oct 30