Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 userManagementForm.jsp authMeth/passWord/pwd1/userName cross site scripting

A vulnerability, which was classified as problematic, was found in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. This affects a function of the file /netflow/jspui/userManagementForm.jsp. The manipulation of the argument authMeth/passWord/pwd1/userName as part of a GET Parameter leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. This is going to have an impact on integrity. An attacker might be able to inject arbitrary html and script code into the web site. This would alter the appearance and would make it possible to initiate further attacks against site visitors.

The weakness was published 05/17/2019 as EDB-ID 46425 as uncorroborated exploit (Exploit-DB). It is possible to read the advisory at exploit-db.com. This vulnerability is uniquely identified as CVE-2019-8928 since 02/18/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known.

After immediately, there has been an exploit disclosed. It is declared as proof-of-concept. The exploit is shared for download at exploit-db.com.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at 135256.

Vendor

• Zoho ManageEngine

Name

• Netflow Analyzer Professional

• ?

• ?

VulDB Meta Base Score: 5.4
VulDB Meta Temp Score: 5.3

VulDB Base Score: 4.7
VulDB Temp Score: 4.6
VulDB Vector: ?
VulDB Reliability: ?

NVD Base Score: 6.1
NVD Vector: ?

VulDB Base Score: ?
VulDB Temp Score: ?
VulDB Reliability: ?

NVD Base Score: ?

Class: Cross site scripting (CWE-79)
Local: No
Remote: Yes

Availability: ?
Access: Public
Status: Proof-of-Concept
Download: ?

Price Prediction: ?
Current Price Estimation: ?

Exploit-DB: ?

Threat Intelligenceinfoedit

Threat: ?
Adversaries: ?
Geopolitics: ?
Economy: ?
Predictions: ?
Remediation: ?Recommended: no mitigation known
0-Day Time: ?
Exploit Delay Time: ?02/18/2019 CVE assigned
05/17/2019 +88 days Advisory disclosed
05/17/2019 +0 days Exploit disclosed
05/17/2019 +0 days EDB entry disclosed
05/18/2019 +1 days VulDB entry created
05/18/2019 +0 days VulDB last updateAdvisory: EDB-ID 46425
Status: Uncorroborated

CVE: CVE-2019-8928 (?)
See also: ?

Created: 05/18/2019 09:47 AM
Complete: ?

Comments

Comments are closed.