vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-47211

HIGH
8.6
CVSS Score
Published: January 8, 2024 at 02:45 PM UTC
Updated: June 17, 2026 at 06:32 AM UTC
8 products affected across 2 vendorsManageengine OpmanagerManageengine Netflow AnalyzerManageengine Firewall Analyzer

Using OpManager by ManageEngine?

Get instant alerts when new vulnerabilities affect OpManager - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.6
Exploit prediction
EPSS 47%
SSVC
PoC

Description

A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Manageengine Firewall Analyzer· Zohocorp
95%
v < 12.712.7 build12700012.7 build12710112.7 build12713012.7 build12713112.7 build12718712.7 build12724412.7 build12725712.7 build127259
Affected range stops below 12.7, so it looks safe — our inference, not a vendor statement
Manageengine Netflow Analyzer· Zohocorp
95%
v < 12.712.7 build12700012.7 build12700312.7 build12710112.7 build12713012.7 build12713112.7 build12718712.7 build12724412.7 build12725512.7 build12725712.7 build127259
Affected range stops below 12.7, so it looks safe — our inference, not a vendor statement
Manageengine Network Configuration Manager· Zohocorp
95%
v < 12.712.7 build12700012.7 build12710212.7 build12710512.7 build12713212.7 build12724312.7 build12725712.7 build127259
Affected range stops below 12.7, so it looks safe — our inference, not a vendor statement
Manageengine Opmanager· Zohocorp
95%
v < 12.712.7 build12700012.7 build12700112.7 build12700212.7 build12700312.7 build12700412.7 build12710012.7 build12710112.7 build12710212.7 build12710312.7 build12710412.7 build12710912.7 build12711612.7 build12711712.7 build12711812.7 build12711912.7 build12712012.7 build12712212.7 build12712312.7 build12713112.7 build12713312.7 build12713412.7 build12713612.7 build12713812.7 build12714012.7 build12714112.7 build12718512.7 build12718612.7 build12718712.7 build12718812.7 build12718912.7 build12719112.7 build12724012.7 build12724112.7 build12724212.7 build12724312.7 build12725512.7 build12725612.7 build12725712.7 build12725812.7 build127259
Affected range stops below 12.7, so it looks safe — our inference, not a vendor statement
Manageengine Opmanager Msp· Zohocorp
95%
v < 12.712.7 build12710912.7 build12712212.7 build12712312.7 build12713812.7 build12713912.7 build12714012.7 build12714112.7 build12714212.7 build127259
Affected range stops below 12.7, so it looks safe — our inference, not a vendor statement
Manageengine Opmanager Plus· Zohocorp
95%
v < 12.712.7 build12710912.7 build12712212.7 build12712312.7 build12713812.7 build12713912.7 build12714012.7 build12714112.7 build12714212.7 build127259
Affected range stops below 12.7, so it looks safe — our inference, not a vendor statement
Manageengine Oputils· Zohocorp
95%
v < 12.712.7 build12710112.7 build12711712.7 build12713412.7 build12724112.7 build12724212.7 build12725812.7 build127259
Affected range stops below 12.7, so it looks safe — our inference, not a vendor statement
OpManager· Manageengine
60%
12.7.258

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

ExploitThird Party Advisory
Source: [email protected]
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1851
Vendor Advisory
Source: [email protected]
https://www.manageengine.com/itom/advisory/cve-2023-47211.html
Source: af854a3a-2127-422b-91ae-364da2661108
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1851

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.6HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card