# CVE-2018-12998: Zoho Manage Engine - XSS

> Live exploitation tracking for CVE-2018-12998 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2018-12998

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.1
- **Public exploit available:** Yes
- **Affected products:** Zoho ManageEngine
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- **Tags:** web_application

## Description

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

## CrowdSec analysis

[CVE-2018-12998](https://euvd.enisa.europa.eu/vulnerability/CVE-2018-12998) is a reflected cross-site scripting (XSS) vulnerability found in multiple Zoho ManageEngine products, including OpManager and related components. This flaw allows remote attackers to inject arbitrary web script or HTML by manipulating certain parameters in requests to the application’s servlet.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of April 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2018-12998 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2018-12998 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Exploitation attempts are generally identifiable through requests directed at URLs containing `/servlet/com.adventnet.me.opmanager.servlet.failoverhelperservlet`.

## Timeline

- 2018-06-29: CVE Published. CVE-2018-12998 is published to NVD.
- 2025-04-03: Rule Released. CrowdSec releases a rule to detect CVE-2018-12998 exploitation attempts against the CrowdSec Network.
- 2025-04-07: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2018-12998 for the first time.

## References

- https://github.com/unh3x/just4cve/issues/10
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12998.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2018-12998) follows observed exploitation activity for CVE-2018-12998. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.