CVE-2015-0866

Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer, (2) username, or (3) password parameter to HomePage.do.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/archive/1/534564/100/0/threaded
http://www.securityfocus.com/bid/72349	Exploit
https://forums.manageengine.com/topic/security-update-for-supportcenter-plus	Patch Vendor Advisory
https://www.htbridge.com/advisory/HTB23247	Exploit
http://www.securityfocus.com/archive/1/534564/100/0/threaded
http://www.securityfocus.com/bid/72349	Exploit
https://forums.manageengine.com/topic/security-update-for-supportcenter-plus	Patch Vendor Advisory
https://www.htbridge.com/advisory/HTB23247	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:*

History

21 Nov 2024, 02:23

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/archive/1/534564/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/534564/100/0/threaded -
References	~~() http://www.securityfocus.com/bid/72349 - Exploit~~	() http://www.securityfocus.com/bid/72349 - Exploit
References	~~() https://forums.manageengine.com/topic/security-update-for-supportcenter-plus - Patch, Vendor Advisory~~	() https://forums.manageengine.com/topic/security-update-for-supportcenter-plus - Patch, Vendor Advisory
References	~~() https://www.htbridge.com/advisory/HTB23247 - Exploit~~	() https://www.htbridge.com/advisory/HTB23247 - Exploit

Information

Published : 2015-02-02 15:59

Updated : 2024-11-21 02:23

NVD link : CVE-2015-0866

Mitre link : CVE-2015-0866

CVE.ORG link : CVE-2015-0866

JSON object : View

Products Affected

zohocorp

manageengine_supportcenter_plus

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2015-0866", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-02-02T15:59:00.050", "references": [{"url": "http://www.securityfocus.com/archive/1/534564/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/72349", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://forums.manageengine.com/topic/security-update-for-supportcenter-plus", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.htbridge.com/advisory/HTB23247", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/534564/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/72349", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://forums.manageengine.com/topic/security-update-for-supportcenter-plus", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.htbridge.com/advisory/HTB23247", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer, (2) username, or (3) password parameter to HomePage.do."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de XSS en Zoho ManageEngine SupportCenter Plus 7.9 anterior a hotfix 7941 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro (1) fromCustomer, (2) username, o (3) password en HomePage.do."}], "lastModified": "2024-11-21T02:23:52.957", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4CB451E-7584-4E7F-A1E7-D332B4335A32", "versionEndIncluding": "7.9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}