Detections
Analytics
ManageEngine SupportCenter Plus < 7.9 Build 7905 Multiple Vulnerabilities
high Nessus Plugin ID 58976
Language:
Synopsis
The remote host is running a web application affected by multiple vulnerabilities.Description
The remote host is running a version of ManageEngine SupportCenter Plus less than 7.9 build 7905. Such versions are affected by multiple vulnerabilities:- A SQL injection vulnerability in the 'countSql' parameter of the '/servlet/AJaxServlet' script.
- Multiple stored cross-site scripting vulnerabilities that can be exploited by both authenticated and anonymous users.
- A vulnerability that allows any authenticated user to delete SupportCenter backups.
- A vulnerability that allows any authenticated user to schedule and write a backup file to a publicly accessible directory.
Solution
Upgrade to ManageEngine SupportCenter version 7.9 build 7905 or later.See Also
Plugin Details
Severity: High
ID: 58976
File Name: manageengine_supportcenter_7905.nasl
Version: 1.6
Type: remote
Family: CGI abuses
Published: 5/3/2012
Updated: 3/23/2022
Supported Sensors: Nessus
Risk Information
CVSS Score Rationale: Score based on an in-depth analysis of the vulnerabilities.
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.4
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: manual
CVSS v3
Risk Factor: High
Base Score: 7.4
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Vulnerability Information
CPE: cpe:/a:manageengine:supportcenter_plus
Required KB Items: installed_sw/ManageEngine SupportCenter
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/15/2012
Vulnerability Publication Date: 1/5/2012
Reference Information
BID: 53019