CVE-2009-4387: XSS
The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for malicious inputs, which allows remote attackers to inject arbitrary web script or HTML via the searchtext parameter and other unspecified inputs.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4387?
CVE-2009-4387 has been rated as a medium severity vulnerability due to its potential for exploitation through cross-site scripting (XSS).
How do I fix CVE-2009-4387?
To fix CVE-2009-4387, upgrade ManageEngine Password Manager Pro to version 6.1 Build 6104 or later where the vulnerability has been addressed.
What software versions are affected by CVE-2009-4387?
CVE-2009-4387 affects ManageEngine Password Manager Pro versions 4.6 to 6.0 and all versions up to 6.1 before Build 6104.
What type of attack does CVE-2009-4387 involve?
CVE-2009-4387 involves a cross-site scripting (XSS) attack where remote attackers can inject arbitrary web scripts or HTML.
Can CVE-2009-4387 be exploited remotely?
Yes, CVE-2009-4387 can be exploited remotely due to the vulnerability in the input validation for the searchtext parameter.