CVE-2017-11560: XSS
An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the application. Thus, an attacker can inject a malicious JavaScript payload inside the HTML file and upload it to the application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11560?
The severity of CVE-2017-11560 is medium, with a severity value of 5.4.
How does CVE-2017-11560 affect ZOHO ManageEngine OpManager?
CVE-2017-11560 affects ZOHO ManageEngine OpManager version 12.2.
What is the Common Weakness Enumeration (CWE) ID for CVE-2017-11560?
The Common Weakness Enumeration (CWE) ID for CVE-2017-11560 is CWE-79.
How can an authenticated user exploit CVE-2017-11560?
An authenticated user can exploit CVE-2017-11560 by adding a Google Map to the application and uploading a malicious HTML file, which is then rendered and interpreted by the application.
Are there any references available for CVE-2017-11560?
Yes, reference links for CVE-2017-11560 include: http://manageengine.com, http://opmanager.com, and https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18736.