Lucene search

[email protected]CVE-2018-12998

HistoryJun 29, 2018 - 12:29 p.m.

CVE-2018-12998

2018-06-2912:29:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2018-12998

reflected xss

zoho manageengine

netflow analyzer

security vulnerability

nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.968 High

EPSS

Percentile

99.7%

JSON

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter ‘operation’ to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

CPENameOperatorVersion
zohocorp:manageengine_netflow_analyzerzohocorp manageengine netflow analyzereq-
zohocorp:firewall_analyzerzohocorp firewall analyzereq-
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq-
zohocorp:manageengine_oputilszohocorp manageengine oputilseq-
zohocorp:manageengine_network_configuration_managerzohocorp manageengine network configuration managereq-

CPE	Name	Operator	Version
zohocorp:manageengine_netflow_analyzer	zohocorp manageengine netflow analyzer	eq	-
zohocorp:firewall_analyzer	zohocorp firewall analyzer	eq	-
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	-
zohocorp:manageengine_oputils	zohocorp manageengine oputils	eq	-
zohocorp:manageengine_network_configuration_manager	zohocorp manageengine network configuration manager	eq	-

References

packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html

seclists.org/fulldisclosure/2018/Jul/75

www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-036

github.com/unh3x/just4cve/issues/10

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.968 High

EPSS

Percentile

99.7%

JSON

Related for CVE-2018-12998

prion1 nuclei1 zdt1 packetstorm1