Zoho Manage Engine - XSS (CVE-2018-12998)
Description
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
psychologyCrowdSec Analysis
CVE-2018-12998 is a reflected cross-site scripting (XSS) vulnerability found in multiple Zoho ManageEngine products, including OpManager and related components. This flaw allows remote attackers to inject arbitrary web script or HTML by manipulating certain parameters in requests to the application’s servlet.
CrowdSec has been tracking this vulnerability and its exploits since 3rd of April 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2018-12998 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec data also reveals a clear uptick in attacks involving CVE-2018-12998 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Exploitation attempts are generally identifiable through requests directed at URLs containing /servlet/com.adventnet.me.opmanager.servlet.failoverhelperservlet.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2018-06-29 |
| Rule Released | 2025-04-03 |
| CrowdSec First Seen | 2025-04-07 |