PT-2019-18598 · Zoho · Zoho Manageengine Netflow Analyzer Professional

Rafael Pedrero · Published 2019-03-17 · Updated 2019-03-22 · CVE-2019-7424

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2

Description A security issue exists in the Administration zone of the software, specifically in the "/netflow/jspui/index.jsp" file. The issue is related to the view GET parameter or the following POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName.

Recommendations For Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2, consider restricting access to the vulnerable "/netflow/jspui/index.jsp" file until a patch is available. As a temporary workaround, avoid using the view GET parameter and the POST parameters autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName in the affected API endpoint.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-7424

Affected Products

Zoho Manageengine Netflow Analyzer Professional

References · 5

• 🔥 http://seclists.org/fulldisclosure/2019/Feb/29 · Exploit
• 🔥 http://packetstormsecurity.com/files/151585/Zoho-ManageEngine-Netflow-Analyzer-Professional-7.0.0.2-XSS.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-7424 · Vendor Advisory
• https://manageengine.com/products/netflow/?doc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7424 · Security Note