PT-2018-14077
CVE-2018-17596
·
تاريخ النشر
2018-10-02
·
تاريخ التحديث
2018-11-16
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Zoho ManageEngine AssetExplorer version 6.2.0
Description
A Stored XSS issue was found in Zoho ManageEngine AssetExplorer. The vulnerability can be exploited via the "ciName" or "assetName" parameter in the "/AssetDef.do" API endpoint.
Recommendations
For Zoho ManageEngine AssetExplorer version 6.2.0, consider disabling access to the "/AssetDef.do" API endpoint until a patch is available. As a temporary workaround, restrict the use of the
ciName and assetName parameters in this endpoint to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾