CVE-2018-12998

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/75	Exploit Mailing List Third Party Advisory
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-036	Exploit Third Party Advisory
https://github.com/unh3x/just4cve/issues/10	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zohocorp:firewall_analyzer:-:::::::*
	cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:-:::::::*
	cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:-:::::::*
	cpe:2.3:a:zohocorp:manageengine_opmanager:-:::::::*
	cpe:2.3:a:zohocorp:manageengine_oputils:-:::::::*

History

No history.

Information

Published : 2018-06-29 12:29

Updated : 2023-12-07 20:06

NVD link : CVE-2018-12998

Mitre link : CVE-2018-12998

CVE.ORG link : CVE-2018-12998

JSON object : View

Products Affected

zohocorp

firewall_analyzer
manageengine_network_configuration_manager
manageengine_opmanager
manageengine_netflow_analyzer
manageengine_oputils

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2018-12998", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-06-29T12:29:00.500", "references": [{"url": "http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2018/Jul/75", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-036", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/unh3x/just4cve/issues/10", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet."}, {"lang": "es", "value": "Una vulnerabilidad Cross-Site Scripting (XSS) reflejado en Zoho ManageEngine Netflow Analyzer antes de la build 123137, Network Configuration Manager antes de la build 123128, OpManager antes de la build 123148, OpUtils antes de la build 123161, y Firewall Analyzer antes de la build 123147 permite a los atacantes remotos inyectar scripts web o HTML arbitrarios a trav\u00e9s del par\u00e1metro \"operation\" en /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet."}], "lastModified": "2023-12-07T20:06:40.657", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:firewall_analyzer:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DFC3545-5EE0-4722-BFB6-58B3AF246F87"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0940949F-4EB4-460B-8CE9-56B6387250F3"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA1C4C73-FD72-4EE7-BE63-D83C373E6A3F"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91373406-389A-404C-81A1-BA994B0C06DC"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_oputils:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AE5990D-D4B9-4D55-B221-20A9BF765C0A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}