PT-2019-7895 · Zoho · Zoho Manageengine Opmanager

Publicado 2019-05-23 · Atualizado 2019-05-24 · CVE-2017-11560

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager version 12.2

Description An issue allows an authenticated user to upload an HTML file by adding a Google Map to the application. This uploaded HTML file is rendered in various application locations, and any included JavaScript is interpreted. As a result, an attacker can inject malicious JavaScript into the HTML file and upload it, potentially leading to exploitation.

Recommendations For ZOHO ManageEngine OpManager version 12.2, consider disabling the feature to upload HTML files, especially those containing JavaScript, until a patch is available to prevent malicious JavaScript injection. Restrict access to the Google Map addition feature to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-11560

Produtos afetados

Zoho Manageengine Opmanager

Referências · 5

• 🔥 https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18736 · Exploit
• http://manageengine.com · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-11560 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11560 · Nota de Segurança
• http://opmanager.com · Nota