CVE-2012-1062 Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to show...
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ManageEngine applications manager | = 10.0 | No fix listed |
| ManageEngine applications manager | = 10.1 | No fix listed |
| ManageEngine applications manager | = 10.2 | No fix listed |
| ManageEngine applications manager | = 10.3 | No fix listed |
| ManageEngine applications manager | = 9 | No fix listed |
| ManageEngine applications manager | = 9.1 | No fix listed |
| ManageEngine applications manager | = 9.2 | No fix listed |
| ManageEngine applications manager | = 9.3 | No fix listed |
| ManageEngine applications manager | = 9.4 | No fix listed |
| ManageEngine applications manager | = 9.5 | No fix listed |
References
- 78721 vdb-entry
- 78722 vdb-entry
- packetstormsecurity.org exploit
- 47724 third-party-advisory vendor-advisory
- 51796 vdb-entry
- www.vulnerability-lab.com
- meapplicationsmanager-multiple-xss(72830) vdb-entry