CVE-2023-47211 is a path traversal in the MIB upload feature of ManageEngine OpManager, scored 9.1 Critical in NVD while ManageEngine rates it High. It allows arbitrary file creation outside the intended folder. ManageEngine lists fixed builds for each version range, so upgrade to the one for your build.
What's affected
ManageEngine's advisory lists these products: OpManager, OpManager Nexus, OpManager MSP, NetFlow Analyzer and OpUtils, with a fixed build that depends on your current build. As the advisory lists them:
- Builds 127249 to 127259: fixed in 127260 and above, dated 11-12-2023.
- Builds 127244 to 127247: fixed in 127248, dated 04-01-2024.
- Builds below 127192: fixed in 127193 to 127243, dated 04-01-2024.
The record describes OpManager 12.7.258 and a specially crafted HTTP request to the uploadMib function, reported in Cisco Talos advisory TALOS-2023-1851. The advisory describes the same area as the MIB Browser, fixed by sanitizing paths so a new MIB is stored only under the OpManager/mibs directory.
The sources differ in three ways. NVD scores it 9.1 Critical, while the vendor labels it High. The record reads as if any attacker can use it, while the vendor says authenticated users with access to MIB Browser can. The CPE list in the record names ManageEngine Firewall Analyzer, which does not match the OpManager text. Use the vendor's table.
The NVD record was published on 2024-01-08, scores 9.1 (Critical), and carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. Weakness class: CWE-22.
How to check if you're exposed
Find your OpManager build in the web console under the About or Help menu, and compare it with the table above. The build number is the string such as 127258.
- Note which ManageEngine products you run, since NetFlow Analyzer and OpUtils share the issue as listed.
- Check the build of each.
- Review the list of users who can open MIB Browser, and the upload activity in logs.
If any build falls in the vulnerable ranges, schedule the upgrade pack from ManageEngine.
What to do now
- List every OpManager, NetFlow Analyzer, OpUtils and OpManager MSP installation and its build number.
- Download the upgrade pack from ManageEngine and apply the build for your range, following the vendor instructions.
- Restrict MIB Browser access to the few administrators who need it.
- Look for unexpected files outside the OpManager/mibs directory created around upload activity.
- Keep the web console off the public internet and behind a VPN.
Why it matters
Path traversal, CWE-22, happens when a file name from a request is used to build a path without being cleaned. An attacker can move the target outside the intended folder. For an upload feature that means writing a file where the product, or the system, will later use it.
Arbitrary file creation on a monitoring server is serious because those servers sit in privileged network positions and hold credentials for many devices. The vendor's severity is lower because it requires an authenticated user, so account hygiene reduces the risk. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
Where two ratings differ, use the higher for planning and the lower to understand the conditions.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do NVD and ManageEngine rate it differently?
NVD scores it 9.1 Critical. The vendor labels it High and says authenticated users with MIB Browser access are the ones who can use it. Plan with the higher number.
Sources
- ManageEngine advisory for CVE-2023-47211
- Cisco Talos report TALOS-2023-1851 (listed in the record, not readable in my fetch)
Last reviewed: 19 October 2026.
