PT-2008-2106 · Zoho · Zoho Manageengine Applications Manager

Publicado 2008-01-29 · Atualizado 2017-08-08 · CVE-2008-0474

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager version 8.1 build 8100

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several parameters in different API endpoints, including: "jsp/DiscoveryProfiles.jsp" with the showlink parameter, "jsp/ThresholdActionConfiguration.jsp" with the attributeIDs, attributeToSelect, redirectto, and resourceid parameters, "jsp/UpdateGlobalSettings.jsp" with the page and redirect parameters, and "showTile.do" with the haid and returnpath parameters.

Recommendations For ManageEngine Applications Manager version 8.1 build 8100, consider disabling access to the vulnerable API endpoints until a patch is available. Restrict input for the showlink, attributeIDs, attributeToSelect, redirectto, resourceid, page, redirect, haid, and returnpath parameters to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-0474

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 6

• 🔥 https://exploit-db.com/exploits/20171 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0474 · Nota
• http://secunia.com/advisories/28332 · Aviso do Fabricante
• http://securityfocus.com/bid/27443 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0474 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39914 · Nota