CVE-2012-1062: XSS
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUpGraph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1062?
CVE-2012-1062 is classified as a medium severity vulnerability due to its potential for exploitation through cross-site scripting.
How do I fix CVE-2012-1062?
To fix CVE-2012-1062, you should upgrade ManageEngine Applications Manager to the latest version that addresses the XSS vulnerabilities.
What are the affected versions for CVE-2012-1062?
CVE-2012-1062 affects ManageEngine Applications Manager versions 9.x and 10.x.
Can CVE-2012-1062 be exploited remotely?
Yes, CVE-2012-1062 can be exploited remotely by attackers to inject arbitrary web scripts or HTML.
What parameters are vulnerable in CVE-2012-1062?
The vulnerable parameters in CVE-2012-1062 include period, selectedNetwork, network, and group in specific application endpoints.