CVE-2024-10839 HIGH

CVE-2024-10839: XML External Entity

Vendor Manageengine

Product SharePoint Manager Plus

Weakness CWE-611 · XXE

Published November 8, 2024

Last update November 8, 2024

View on NVD All CVEs

CVSS base score

8.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option.

Key dates

02Disclosure timeline

November 8, 2024 CVE published

November 8, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-10839 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/611.html

Related vulnerabilities

04Related CVE

CVE-2025-10713 XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration CVE-2023-51605 Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability CVE-2026-40998 Jaxp13 XPath XXE via StreamSource and SAXSource CVE-2024-52596 SimpleSAMLphp xml-common XXE vulnerability CVE-2021-41098 Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby