PT-2008-2106 · Zoho · Zoho Manageengine Applications Manager

Published 2008-01-29 · Updated 2017-08-08 · CVE-2008-0474

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager version 8.1 build 8100

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several parameters in different API endpoints, including: "jsp/DiscoveryProfiles.jsp" with the showlink parameter, "jsp/ThresholdActionConfiguration.jsp" with the attributeIDs, attributeToSelect, redirectto, and resourceid parameters, "jsp/UpdateGlobalSettings.jsp" with the page and redirect parameters, and "showTile.do" with the haid and returnpath parameters.

Recommendations For ManageEngine Applications Manager version 8.1 build 8100, consider disabling access to the vulnerable API endpoints until a patch is available. Restrict input for the showlink, attributeIDs, attributeToSelect, redirectto, resourceid, page, redirect, haid, and returnpath parameters to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0474

Affected Products

Zoho Manageengine Applications Manager

References · 6

• 🔥 https://exploit-db.com/exploits/20171 · Exploit
• http://secunia.com/advisories/28332 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0474 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0474 · Note
• http://securityfocus.com/bid/27443 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39914 · Note