CVE-2007-3593

EPSS 4.1%

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine NetFlow Analyzer 5 allow remote attackers to inject arbitrary web script or HTML via the (1) alpha parameter in (a) netflow/jspui/applicationList.jsp, the (2) task parameter in (b) netflow/jspui/appConfig.jsp, the (3) view parameter in (c) netflow/jspui/index.jsp, and the (4) rtype parameter in (d) netflow/jspui/selectDevice.jsp and (e) netflow/jspui/customReport.jsp. NOTE: it was later reported that vector 3 also affects 7.5 build 7500.

Affected products

n/a · n/a

public PoCs found — 5

exploitdbwww.exploit-db.com/exploits/30267unverified exploitdbwww.exploit-db.com/exploits/30266unverified exploitdbwww.exploit-db.com/exploits/30270unverified exploitdbwww.exploit-db.com/exploits/30269unverified exploitdbwww.exploit-db.com/exploits/30268unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://lostmon.blogspot.com/2007/07/netflow-analizer-5-opmanager-7-multiple.html http://osvdb.org/37826 http://osvdb.org/37827 http://osvdb.org/37828 http://osvdb.org/37829 http://osvdb.org/37830 http://secunia.com/advisories/25947 https://exchange.xforce.ibmcloud.com/vulnerabilities/35263 http://www.securityfocus.com/bid/24766