PT-2018-14077
CVE-2018-17596
·
Publicado
2018-10-02
·
Atualizado
2018-11-16
Descrição por
CVSS 3.1
6.1
MédiaMétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Zoho ManageEngine AssetExplorer version 6.2.0
Description
A Stored XSS issue was found in Zoho ManageEngine AssetExplorer. The vulnerability can be exploited via the "ciName" or "assetName" parameter in the "/AssetDef.do" API endpoint.
Recommendations
For Zoho ManageEngine AssetExplorer version 6.2.0, consider disabling access to the "/AssetDef.do" API endpoint until a patch is available. As a temporary workaround, restrict the use of the
ciName and assetName parameters in this endpoint to minimize the risk of exploitation.Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾