Detections
Analytics
ManageEngine OpStor availability730.do days Parameter XSS
medium Nessus Plugin ID 62784
Language:
Synopsis
A web application on the remote host is affected by a cross-site scripting vulnerability.Description
The remote ManageEngine OpStor install is affected by a cross-site scripting vulnerability. The application does not properly sanitize the 'days' parameter on the 'availability730.do' script.A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL. Exploitation could also allow the attacker to steal cookie-based authentication credentials.
The application is also reported to be vulnerable to SQL injection attacks as well as a cross-site scripting attack involving the 'name' parameter of the 'availability730.do' script, although Nessus has not checked for those issues.
Solution
There is currently no patch available from the vendor.See Also
Plugin Details
Severity: Medium
ID: 62784
File Name: manageengine_opstor_availability730_xss.nasl
Version: 1.11
Type: remote
Family: CGI abuses : XSS
Published: 11/1/2012
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.6
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:zohocorp:manageengine_opstor
Required KB Items: www/manageengine_opstor
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Exploited by Nessus: true
Vulnerability Publication Date: 8/17/2012
Reference Information
BID: 55070