VulnerabilityModified
CVE-2016-9490
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability.
MEDIUM 6.1EPSS 1.73%
Does this matter?
Lower severity and a low EPSS score (1.73%). Track it; it rarely justifies an emergency change on its own.
Description
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also available without authentication.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.73% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- manageengine/applications manager
- Source
- cret@cert.org
References
- http://seclists.org/fulldisclosure/2017/Apr/9Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/97394Third Party Advisory, VDB Entry
- https://packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.htmlThird Party Advisory, VDB Entry
- https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9490.html
- http://seclists.org/fulldisclosure/2017/Apr/9Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/97394Third Party Advisory, VDB Entry
- https://packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.htmlThird Party Advisory, VDB Entry
- https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9490.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.