CVE-2017-11560: XSS
First published: Thu May 23 2019(Updated: )
An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the application. Thus, an attacker can inject a malicious JavaScript payload inside the HTML file and upload it to the application.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp Manageengine Opmanager | =12.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-11560?
The severity of CVE-2017-11560 is medium, with a severity value of 5.4.
How does CVE-2017-11560 affect ZOHO ManageEngine OpManager?
CVE-2017-11560 affects ZOHO ManageEngine OpManager version 12.2.
What is the Common Weakness Enumeration (CWE) ID for CVE-2017-11560?
The Common Weakness Enumeration (CWE) ID for CVE-2017-11560 is CWE-79.
How can an authenticated user exploit CVE-2017-11560?
An authenticated user can exploit CVE-2017-11560 by adding a Google Map to the application and uploading a malicious HTML file, which is then rendered and interpreted by the application.
Are there any references available for CVE-2017-11560?
Yes, reference links for CVE-2017-11560 include: http://manageengine.com, http://opmanager.com, and https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18736.
- collector/nvd-index
- vendor/zohocorp
- canonical/zohocorp manageengine opmanager
- version/zohocorp manageengine opmanager/12.2