CVE-2017-11739

In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the dashboard where it was added. An attacker can abuse this functionality by creating a "Utility Widget" that contains malicious JavaScript code, aka XSS.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://application.com	Not Applicable
http://manageengine.com	Vendor Advisory
http://www.securityfocus.com/bid/108469
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18734	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zohocorp:manageengine_applications_manager:13.1:13100:*:*:*:*:*:*

History

No history.

Information

Published : 2019-05-23 16:29

Updated : 2024-02-04 20:20

NVD link : CVE-2017-11739

Mitre link : CVE-2017-11739

CVE.ORG link : CVE-2017-11739

JSON object : View

Products Affected

zohocorp

manageengine_applications_manager

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2017-11739", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2019-05-23T16:29:08.213", "references": [{"url": "http://application.com", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "http://manageengine.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/108469", "source": "cve@mitre.org"}, {"url": "https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18734", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a \"Utility Widget\" with a \"Custom HTML or Text\" field. Once this widget is created, it will be loaded on the dashboard where it was added. An attacker can abuse this functionality by creating a \"Utility Widget\" that contains malicious JavaScript code, aka XSS."}, {"lang": "es", "value": "En Zoho ManageEngine Application Manager 13.1 Build 13100, un usuario autenticado, con privilegios administrativos, tiene la facultad de agregar un widget en cualquier panel. Este widget puede ser un \"Utility Widget\" con un campo \"Custom HTML or Text\". Una vez que este widget sea creado, ser\u00e1 cargado en el panel donde fue agregado. Un atacante puede abusar de esta funcionalidad mediante la creaci\u00f3n de un \"Utility Widget\" que contenga un c\u00f3digo JavaScript malicioso, tambi\u00e9n conocido como XSS."}], "lastModified": "2019-05-27T12:29:00.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_applications_manager:13.1:13100:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0ADA2415-EC81-4764-9649-010776AF62CB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}