PT-2015-5023 · Zoho · Zoho Manageengine Admanager Plus
Publicado
2015-03-11
·
Atualizado
2019-04-12
·
CVE-2015-1026
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
ManageEngine ADManager Plus versions prior to 6.2 Build 6270
Description
The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the
technicianSearchText parameter to the "Help Desk Technician" page or the rolesSearchText parameter to the "Help Desk Roles" page.Recommendations
For ManageEngine ADManager Plus versions prior to 6.2 Build 6270, update to version 6.2 Build 6270 or later to resolve the issue. As a temporary workaround, consider restricting access to the Help Desk Technician and Help Desk Roles pages until the update is applied. Avoid using the
technicianSearchText and rolesSearchText parameters in the affected pages until the issue is resolved.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Zoho Manageengine Admanager Plus