« Back to list

CVE-2019-12596

Status: ModifiedMedium (6.1)—

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Zohocorp — Manageengine Assetexplorer

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2019-12596",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-11T14:15:11.553",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/109364",
      "tags": [
        "Broken Link"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.manageengine.com/products/asset-explorer/sp-readme.html",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/109364",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.manageengine.com/products/asset-explorer/sp-readme.html",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en ManageEngine AssetExplorer de Zoho. Se presenta un problema de tipo XSS por medio del archivo SoftwareListView.do con el parámetro swType o swComplianceType."
    }
  ],
  "lastModified": "2026-06-17T02:14:56.227",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF41DB4F-2C03-4F82-928B-F32BB5C05FF0"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6500:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F5A89AB-95BD-41DB-A9A2-BADD8A4DB582"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6501:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "635A3337-6C44-4C1F-AF5D-A0CF09CECA01"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6502:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AB6A11B-CC19-49A3-90E8-87ECF41EA4EE"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6503:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "836F0656-0063-487C-A0B8-9196CED6D74E"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.5:6504:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2780806E-1FF4-440F-A69D-A2E93E8761E3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}