Cross-Site Scripting in Zoho ManageEngine Netflow Analyzer by Zoho
CVE-2019-7427

6.1MEDIUM

Key Information:

Vendor

Zohocorp
Status
Manageengine Netflow Analyzer
Vendor
CVE Published:
7 May 2019

What is CVE-2019-7427?

The ManageEngine Netflow Analyzer Professional is susceptible to Cross-Site Scripting (XSS) attacks due to improper handling of user input in the Administration interface. Specifically, the vulnerability arises from the processing of the 'autorefTime' or 'graphTypes' parameters in the '/netflow/jspui/linkdownalertConfig.jsp' file. This flaw can be exploited by unauthenticated attackers, allowing them to inject malicious scripts into web pages viewed by users, potentially leading to session hijacking, data theft, or other malicious actions. Users are advised to implement security best practices and apply relevant patches from Zoho to mitigate this risk.

References

http://packetstormsecurity.com/files/151585/Zoho-ManageEn...
x_refsource_MISC
http://seclists.org/fulldisclosure/2019/Feb/29
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.