Detections
Analytics
ManageEngine AssetExplorer < 5.6.0 Build 5614 XML Asset Data XSS
low Nessus Plugin ID 63694
Language:
Synopsis
The remote web server is affected by a cross-site scripting vulnerability.Description
The version of ManageEngine AssetExplorer running on the remote host is prior to 5.6.0 build 5614. It is, therefore, affected by a cross-site scripting vulnerability in WsDiscoveryServlet due to improper validation of certain XML asset data before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in the user's browser session.Solution
Upgrade ManageEngine AssetExplorer to version 5.6.0 build 5614 or later.See Also
Plugin Details
Severity: Low
ID: 63694
File Name: manageengine_assetexplorer_5610.nasl
Version: 1.9
Type: remote
Family: CGI abuses : XSS
Published: 1/24/2013
Updated: 3/18/2022
Supported Sensors: Nessus
Risk Information
CVSS Score Rationale: Score based on an in-depth analysis of the vulnerabilities.
VPR
Risk Factor: Low
Score: 1.4
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: manual
CVSS v3
Risk Factor: Low
Base Score: 3.1
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Vulnerability Information
CPE: cpe:/a:zoho:manageengine_assetexplorer
Required KB Items: installed_sw/ManageEngine AssetExplorer
Exploit Ease: No exploit is required
Patch Publication Date: 12/6/2012
Vulnerability Publication Date: 12/6/2012
Reference Information
CVE: CVE-2012-5956
BID: 56835