CVE-2018-12998 - A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet

Back Back to CVE browser

MEDIUM

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet

Published Jun 29, 2018

6.1

MEDIUM

CVSS 3.1

EPSS 99.29%

Description

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2018/Jul/75
mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-036
x_refsource_MISCExploitThird Party Advisory
https://github.com/unh3x/just4cve/issues/10
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2018/Jul/75		mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-036		x_refsource_MISCExploitThird Party Advisory
https://github.com/unh3x/just4cve/issues/10		x_refsource_MISCExploitThird Party Advisory