Detections
Analytics
ManageEngine ServiceDesk Plus 9.2.0 < Build 9228 Multiple Vulnerabilities
medium Nessus Plugin ID 94327
Language:
Synopsis
The remote web server hosts an application that is affected by multiple vulnerabilities.Description
The remote host is running ManageEngine ServiceDesk Plus version 9.2.0 prior to build 9228. It is, therefore, affected by multiple vulnerabilities :- A cross-site scripting vulnerability exists due to improper validation of input before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session.
(CVE-2016-4888)
- An information disclosure vulnerability exists due to insecure generation of cookies. An unauthenticated, remote attacker can exploit this to disclose password information by gaining access to a user's cookie.
(CVE-2016-4890)
- An unspecified flaw exists when adding notes for 'Problems'. An unauthenticated, remote attacker can exploit this to cause an unspecified impact.
- An unspecified flaw exists that is related to scanned XML files. An unauthenticated, remote attacker can exploit this to cause an unspecified impact.
- An unspecified flaw exists when trying to delete the Change Template. An unauthenticated, remote attacker can exploit this to cause an unspecified impact.
- An unspecified flaw exists when updating or deleting the Change workflow. An unauthenticated, remote attacker can exploit this to cause an unspecified impact.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to ManageEngine ServiceDesk Plus version 9.2.0 build 9228 or later.See Also
https://www.manageengine.com/products/service-desk/readme.html#readme92
Plugin Details
Severity: Medium
ID: 94327
File Name: manageengine_servicedesk_9_2_build9228.nasl
Version: 1.9
Type: remote
Family: CGI abuses
Published: 10/27/2016
Updated: 10/27/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2016-4890
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:manageengine:servicedesk_plus
Required KB Items: installed_sw/manageengine_servicedesk
Exploit Ease: No known exploits are available
Patch Publication Date: 9/29/2016
Vulnerability Publication Date: 9/29/2016
Reference Information
CVE: CVE-2016-4888, CVE-2016-4890