Cross-Site Scripting Flaw in Zoho ManageEngine Netflow Analyzer

CVE-2019-8927

What is CVE-2019-8927?

A Cross-Site Scripting (XSS) vulnerability was identified in Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2, affecting the Administration zone. The vulnerability occurs in the 'scheduleConfig.jsp' file, allowing attackers to exploit specific GET parameters such as devSrc, emailId, and others to inject malicious scripts into the application. This could potentially lead to unauthorized actions being executed on behalf of the administrator, thereby compromising the security of the system.

References