PT-2012-3051 · Zoho+1 · Zoho Manageengine Applications Manager+1

Benjamin Kunz Mejri + 3 · Published 2012-02-14 · Updated 2017-08-29 · CVE-2012-1062

Mitre

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-1062

Affected Products

Zoho Manageengine Applications Manager

Applications Manager

References · 9

• 🔥 http://packetstormsecurity.org/files/view/109238/VL-115.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1062 · Security Note
• http://secunia.com/advisories/47724 · Vendor Advisory
• http://securityfocus.com/bid/51796 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72830 · Note
• http://osvdb.org/78722 · Note
• http://osvdb.org/78721 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1062 · Note
• http://vulnerability-lab.com/get_content.php?id=115 · Note