PT-2008-3006 · Manageengine · Manageengine Supportcenter Plus

Publicado 2008-03-20 · Atualizado 2008-09-05 · CVE-2008-1432

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine SupportCenter Plus version 7.0.0

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the searchText parameter in the "SolutionSearch.do" endpoint.

Recommendations For ManageEngine SupportCenter Plus version 7.0.0, as a temporary workaround, consider restricting access to the SolutionSearch.do endpoint until a patch is available. Avoid using the searchText parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-1432

Produtos afetados

Manageengine Supportcenter Plus

Referências · 2

• http://secunia.com/advisories/29441 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-1432 · Nota de Segurança