CVE-2018-10803

CWE-79 — Cross-site Scripting (XSS)CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources

Severity

6.1MEDIUM

EPSS

0.3%

top 49.13%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Netflow Analyzer

Timeline

PublishedMay 10

Latest updateMay 13

Description

Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDzohocorp/manageengine_netflow_analyzer12.3 — 12.3.125

🔴Vulnerability Details

GHSA

GHSA-jwv4-w94q-2w62: Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12↗2022-05-13

▶

CVEList

CVE-2018-10803: Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12↗2018-05-10

▶