Cross-Site Scripting Vulnerability in ManageEngine ServiceDesk Plus for Windows
CVE-2008-1299

6.1MEDIUM

Key Information:

Vendor

Manageengine
Status
Servicedesk Plus
Vendor
CVE Published:
12 March 2008

What is CVE-2008-1299?

A Cross-Site Scripting (XSS) vulnerability exists in ManageEngine ServiceDesk Plus version 7.0.0 Build 7011 for Windows. This flaw allows remote attackers to inject arbitrary web script or HTML through the 'searchText' parameter in the SolutionSearch.do module. When exploited, this vulnerability can lead to unauthorized access, data manipulation, and session hijacking, compromising the integrity of the application and the security of its users.

References

http://secunia.com/advisories/29310
third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/28191
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.