PT-2011-1776 · Manageengine · Zoho Manageengine Eventlog Analyzer
Published
2011-09-27
·
Updated
2020-03-26
·
CVE-2010-4841
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
ManageEngine EventLog Analyzer version 6.1
Description
The issue concerns multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can be achieved via various parameters to different API endpoints, such as the
HOST ID, OS, GROUP, exportFile, load, type, or tab parameter to "INDEX.do", the reported parameter to "INDEX2.do", the gId parameter to "hostlist.do", the newWindow parameter to "globalSettings.do", or the STATUS parameter to "enableHost.do".Recommendations
For ManageEngine EventLog Analyzer version 6.1, update to a version that includes Build 9000 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints, such as "INDEX.do", "INDEX2.do", "hostlist.do", "globalSettings.do", and "enableHost.do", until the update is applied. Avoid using the vulnerable parameters, such as
HOST ID, OS, GROUP, exportFile, load, type, tab, reported, gId, newWindow, and STATUS, in the respective API endpoints until the issue is resolved.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zoho Manageengine Eventlog Analyzer