CVE-2009-4387
Severity Score
4.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for malicious inputs, which allows remote attackers to inject arbitrary web script or HTML via the searchtext parameter and other unspecified inputs.
Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en ShowInContentAreaAction.do en ManageEngine Password Manager Pro (PMP) en versiónes anteriores a v6.1 Build 6104 utiliza comprobación del uso de mayúsculas/minúsculas para entradas maliciosas, lo que permite a atacantes remotos inyectar secuencias de comandos web o HTML de forma arbitraria a través del parámetro "searchtext" y otras entradas sin especificar.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2009-12-22 CVE Reserved
- 2009-12-22 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://forums.manageengine.com/#Topic/49000003740390 | X_refsource_confirm | |
| http://www.securityfocus.com/bid/37336 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| http://www.scip.ch/publikationen/advisories/scip_advisory-4063_manageengine_pmp_script_injection.txt | 2024-09-16 |
| URL | Date | SRC |
|---|---|---|
| http://www.manageengine.com/products/passwordmanagerpro/release-notes.html | 2009-12-23 | |
| http://www.scip.ch/?vuldb.4063 | 2009-12-23 | |
| http://www.vupen.com/english/advisories/2009/3540 | 2009-12-23 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/37765 | 2009-12-23 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | <= 6.1 Search vendor "Manageengine" for product "Password Manager Pro" and version " <= 6.1" | - |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | <= 6.1 Search vendor "Manageengine" for product "Password Manager Pro" and version " <= 6.1" | standard |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | 4.6 Search vendor "Manageengine" for product "Password Manager Pro" and version "4.6" | - |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | 4.7 Search vendor "Manageengine" for product "Password Manager Pro" and version "4.7" | - |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | 4.8 Search vendor "Manageengine" for product "Password Manager Pro" and version "4.8" | - |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | 5.0 Search vendor "Manageengine" for product "Password Manager Pro" and version "5.0" | - |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | 5.1 Search vendor "Manageengine" for product "Password Manager Pro" and version "5.1" | - |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | 5.2 Search vendor "Manageengine" for product "Password Manager Pro" and version "5.2" | - |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | 5.3 Search vendor "Manageengine" for product "Password Manager Pro" and version "5.3" | - |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | 5.4 Search vendor "Manageengine" for product "Password Manager Pro" and version "5.4" | - |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro Search vendor "Manageengine" for product "Password Manager Pro" | 6.0 Search vendor "Manageengine" for product "Password Manager Pro" and version "6.0" | - |
Affected
| ||||||
| Manageengine Search vendor "Manageengine" | Password Manager Pro6.1 Search vendor "Manageengine" for product "Password Manager Pro6.1" | * | free |
Affected
| ||||||