PT-2019-7895 · Zoho · Zoho Manageengine Opmanager

Published 2019-05-23 · Updated 2019-05-24 · CVE-2017-11560

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager version 12.2

Description An issue allows an authenticated user to upload an HTML file by adding a Google Map to the application. This uploaded HTML file is rendered in various application locations, and any included JavaScript is interpreted. As a result, an attacker can inject malicious JavaScript into the HTML file and upload it, potentially leading to exploitation.

Recommendations For ZOHO ManageEngine OpManager version 12.2, consider disabling the feature to upload HTML files, especially those containing JavaScript, until a patch is available to prevent malicious JavaScript injection. Restrict access to the Google Map addition feature to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-11560

Affected Products

Zoho Manageengine Opmanager

References · 5

• 🔥 https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18736 · Exploit
• http://manageengine.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11560 · Security Note
• http://opmanager.com · Note