« Volver al listado

CVE-2019-12597

Estado: ModificadaMedia (6.1)—

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zohocorp — Manageengine Assetexplorer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-12597",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-11T14:15:11.617",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/109364",
      "tags": [
        "Broken Link"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.manageengine.com/products/asset-explorer/sp-readme.html",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/109364",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.manageengine.com/products/asset-explorer/sp-readme.html",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en ManageEngine AssetExplorer de Zoho. Se presenta un problema de tipo XSS por medio del archivo ResourcesAttachments.jsp con el parámetro pageName."
    }
  ],
  "lastModified": "2026-06-17T02:14:56.347",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF41DB4F-2C03-4F82-928B-F32BB5C05FF0"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6500:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F5A89AB-95BD-41DB-A9A2-BADD8A4DB582"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6501:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "635A3337-6C44-4C1F-AF5D-A0CF09CECA01"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6502:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AB6A11B-CC19-49A3-90E8-87ECF41EA4EE"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6503:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "836F0656-0063-487C-A0B8-9196CED6D74E"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6504:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2780806E-1FF4-440F-A69D-A2E93E8761E3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}