« Volver al listado

CVE-2024-38870

Estado: AplazadaBaja (3.5)—

Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Zohocorp — Manageengine OpmanagerAIZohocorp — Manageengine Opmanager Enterprise EditionAIZohocorp — Manageengine Opmanager MSPAIZohocorp — Manageengine Opmanager PlusAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-38870",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38870",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-23T14:46:16.424061Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "ManageEngine",
          "product": "OpManager, OpManager Plus, OpManager MSP, OpManager Enterprise Edition",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "128104",
              "versionType": "128104"
            },
            {
              "status": "affected",
              "version": "128151",
              "lessThan": "128238",
              "versionType": "128238"
            },
            {
              "status": "affected",
              "version": "128247",
              "lessThan": "128250",
              "versionType": "128250"
            }
          ],
          "collectionURL": "https://www.manageengine.com/network-monitoring/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-07-17T17:15:15.407",
  "references": [
    {
      "url": "https://www.manageengine.com/network-monitoring/security-updates/cve-2024-38870.html",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    },
    {
      "url": "https://www.manageengine.com/network-monitoring/security-updates/cve-2024-38870.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module."
    },
    {
      "lang": "es",
      "value": "Las versiones Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP y OpManager Enterprise Edition anteriores a 128104, 128151 anteriores a 128238 y 128247 anteriores a 128250 son efectados por la vulnerabilidad XSS almacenado en el módulo de informes."
    }
  ],
  "lastModified": "2026-06-17T07:41:10.243",
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02"
}