# CVE-2018-12997: CVE-2018-12997

- Exploited (CISA KEV): no
- Published: 2018-06-29
- CVSS: not scored
- EPSS: 6.6% (94th percentile)

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | Before feed history | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2024-03-12 | 2083 |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

### F5

- 2024-03-12 · new · rule 200009298
  > Added: signature 200009298 "Zoho ManageEngine Arbitrary File Read" (Information Leakage, risk Medium), systems: Microsoft Windows, Java Servlets/JSP, Other Web Server. References: CVE-2018-12997.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2018-12997 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2018-12997