Vulnerability Description
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | Manageengine Applications Manager | <= 13 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSSExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2018/Jul/71ExploitMailing ListThird Party Advisory
- http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-038Third Party Advisory
- https://github.com/unh3x/just4cve/issues/7ExploitThird Party Advisory
- https://www.manageengine.com/products/applications_manager/issues.htmlVendor Advisory
- https://www.manageengine.com/products/applications_manager/security-updates/secuVendor Advisory
- http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSSExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2018/Jul/71ExploitMailing ListThird Party Advisory
- http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-038Third Party Advisory
- https://github.com/unh3x/just4cve/issues/7ExploitThird Party Advisory
- https://www.manageengine.com/products/applications_manager/issues.htmlVendor Advisory
- https://www.manageengine.com/products/applications_manager/security-updates/secuVendor Advisory
FAQ
What is CVE-2018-12996?
CVE-2018-12996 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter ...
How severe is CVE-2018-12996?
CVE-2018-12996 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-12996?
Check the references section above for vendor advisories and patch information. Affected products include: Zohocorp Manageengine Applications Manager.