In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the dashboard where it was added. An attacker can abuse this functionality by creating a "Utility Widget" that contains malicious JavaScript code, aka XSS.
References
| Link | Resource |
|---|---|
| http://application.com | Not Applicable |
| http://manageengine.com | Vendor Advisory |
| http://www.securityfocus.com/bid/108469 | |
| https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18734 | Exploit Third Party Advisory |
| http://application.com | Not Applicable |
| http://manageengine.com | Vendor Advisory |
| http://www.securityfocus.com/bid/108469 | |
| https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18734 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 03:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://application.com - Not Applicable | |
| References | () http://manageengine.com - Vendor Advisory | |
| References | () http://www.securityfocus.com/bid/108469 - | |
| References | () https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18734 - Exploit, Third Party Advisory |
Information
Published : 2019-05-23 16:29
Updated : 2024-11-21 03:08
NVD link : CVE-2017-11739
Mitre link : CVE-2017-11739
CVE.ORG link : CVE-2017-11739
JSON object : View
Products Affected
zohocorp
- manageengine_applications_manager
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')