« Volver al listado

CVE-2019-12596

Estado: ModificadaMedia (6.1)—

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zohocorp — Manageengine Assetexplorer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-12596",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-11T14:15:11.553",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/109364",
      "tags": [
        "Broken Link"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.manageengine.com/products/asset-explorer/sp-readme.html",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/109364",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.manageengine.com/products/asset-explorer/sp-readme.html",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en ManageEngine AssetExplorer de Zoho. Se presenta un problema de tipo XSS por medio del archivo SoftwareListView.do con el parámetro swType o swComplianceType."
    }
  ],
  "lastModified": "2026-06-17T02:14:56.227",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF41DB4F-2C03-4F82-928B-F32BB5C05FF0"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6500:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F5A89AB-95BD-41DB-A9A2-BADD8A4DB582"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6501:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "635A3337-6C44-4C1F-AF5D-A0CF09CECA01"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6502:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AB6A11B-CC19-49A3-90E8-87ECF41EA4EE"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6503:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "836F0656-0063-487C-A0B8-9196CED6D74E"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6504:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2780806E-1FF4-440F-A69D-A2E93E8761E3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}