CVE-2024-10839: XML External Entity

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-08 · updated 2026-06-17
Weakness: CWE-611

Description

Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.

Affected products

ManageEngine SharePoint Manager Plus: 4.0-4000, 4.0-4001, 4.0-4002, 4.0-4003, 4.0-4004, 4.0-4005 (+84)

References

https://www.manageengine.com/sharepoint-management-reporting/advisory/CVE-2024-10839.html

Get alerted when CVE-2024-10839 or the next vulnerability affects your stack