PT-2009-6509 · Manageengine · Manageengine Password Manager Pro

Stefan Friedli · Publicado 2009-12-22 · Atualizado 2009-12-23 · CVE-2009-4387

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine Password Manager Pro (PMP) versions prior to 6.1 Build 6104

Description The issue concerns a flaw in the cross-site scripting (XSS) protection mechanism. This flaw allows remote attackers to inject arbitrary web script or HTML via the searchtext parameter and other unspecified inputs, due to the use of case-sensitive checks for malicious inputs.

Recommendations For versions prior to 6.1 Build 6104, update to version 6.1 Build 6104 or later to resolve the issue. As a temporary workaround, consider restricting access to the searchtext parameter in the affected API endpoint until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-4387

Produtos afetados

Manageengine Password Manager Pro

Referências · 8

• 🔥 http://scip.ch/publikationen/advisories/scip_advisory-4063_manageengine_pmp_script_injection.txt · Exploit
• http://manageengine.com/products/passwordmanagerpro/release-notes.html · Correção
• http://secunia.com/advisories/37765 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/3540 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-4387 · Nota de Segurança
• http://scip.ch/?vuldb.4063 · Correção
• http://securityfocus.com/bid/37336 · Nota
• http://forums.manageengine.com/#Topic/49000003740390 · Nota