CVE-2016-9490 ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability
MediumCVSS 6.1
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also available without authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ManageEngine applications manager | = 12.0 | No fix listed |
| ManageEngine applications manager | = 13.0 | No fix listed |
| ManageEngine applications manager | = 12 | No fix listed |
| ManageEngine applications manager | = 13 | No fix listed |
References
- 20170404 ManageEngine Applications Manager Multiple Vulnerabilities mailing-list third-party-advisory
- 97394 third-party-advisory vdb-entry
- packetstormsecurity.com third-party-advisory vdb-entry
- www.manageengine.com