Details of VAR-201209-0459

ID

VAR-201209-0459

CVE

CVE-2012-4891

TITLE

ManageEngine Firewall Analyzer of fw/index2.do Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2012-004281

DESCRIPTION

Cross-site scripting (XSS) vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vector than CVE-2012-4889. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. ManageEngine Firewall Analyzer of fw/index2.do Contains a cross-site scripting vulnerability. ZOHO ManageEngine Firewall Analyzer is a set of web-based firewall log analysis tools from ZOHO, USA. It can collect, correlate analysis and report logs on firewalls, proxy servers and Radius servers throughout the enterprise. ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: ManageEngine Firewall Analyzer Multiple Cross-Site Scripting Vulnerabilities SECUNIA ADVISORY ID: SA48657 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48657/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48657 RELEASE DATE: 2012-04-02 DISCUSS ADVISORY: http://secunia.com/advisories/48657/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/48657/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=48657 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Vulnerability Lab has discovered multiple vulnerabilities in ManageEngine Firewall Analyzer, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the "subTab" parameter to fw/createAnomaly.do, the "url" parameter to fw/mindex.do, the "url" and "tab" parameters to fw/index2.do, and the "port" parameter to fw/syslogViewer.do is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerabilities are confirmed in version 7.2. Other versions may also be affected. SOLUTION: Filter malicious characters and character sequences using a proxy. PROVIDED AND/OR DISCOVERED BY: Vulnerability Lab. ORIGINAL ADVISORY: http://www.vulnerability-lab.com/get_content.php?id=437 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2012-4891 // JVNDB: JVNDB-2012-004281 // BID: 73625 // VULHUB: VHN-58172 // PACKETSTORM: 111465

AFFECTED PRODUCTS

vendor:	manageengine	model:	firewall analyzer	scope:	eq	version:	7.2	Trust: 1.9
vendor:	zoho	model:	manageengine firewall analyzer	scope:	eq	version:	7.2	Trust: 0.8

sources: BID: 73625 // JVNDB: JVNDB-2012-004281 // CNNVD: CNNVD-201209-209 // NVD: CVE-2012-4891

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-4891
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2012-4891
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201209-209
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-58172
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2012-4891
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-58172
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-58172 // JVNDB: JVNDB-2012-004281 // CNNVD: CNNVD-201209-209 // NVD: CVE-2012-4891

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-58172 // JVNDB: JVNDB-2012-004281 // NVD: CVE-2012-4891

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201209-209

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 111465 // CNNVD: CNNVD-201209-209

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-004281

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-58172

PATCH

title:

Firewall Analyzer

url:

http://www.manageengine.com/products/firewall/

Trust: 0.8

sources: JVNDB: JVNDB-2012-004281

EXTERNAL IDS

db:	NVD	id:	CVE-2012-4891	Trust: 2.8
db:	SECUNIA	id:	48657	Trust: 1.8
db:	OSVDB	id:	80874	Trust: 1.7
db:	PACKETSTORM	id:	130169	Trust: 1.2
db:	EXPLOIT-DB	id:	35933	Trust: 1.1
db:	JVNDB	id:	JVNDB-2012-004281	Trust: 0.8
db:	CNNVD	id:	CNNVD-201209-209	Trust: 0.7
db:	BID	id:	73625	Trust: 0.4
db:	VULHUB	id:	VHN-58172	Trust: 0.1
db:	PACKETSTORM	id:	111465	Trust: 0.1

sources: VULHUB: VHN-58172 // BID: 73625 // JVNDB: JVNDB-2012-004281 // PACKETSTORM: 111465 // PACKETSTORM: 130169 // CNNVD: CNNVD-201209-209 // NVD: CVE-2012-4891

REFERENCES

url:	http://osvdb.org/80874	Trust: 1.7
url:	http://secunia.com/advisories/48657	Trust: 1.7
url:	http://www.exploit-db.com/exploits/35933	Trust: 1.1
url:	http://packetstormsecurity.com/files/130169/manageengine-firewall-analyzer-8.0-directory-traversal-xss.html	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/100551	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4891	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4891	Trust: 0.8
url:	http://secunia.com/advisories/48657/	Trust: 0.1
url:	http://secunia.com/psi_30_beta_launch	Trust: 0.1
url:	http://secunia.com/vulnerability_intelligence/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/personal/	Trust: 0.1
url:	http://www.vulnerability-lab.com/get_content.php?id=437	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=48657	Trust: 0.1
url:	http://secunia.com/advisories/48657/#comments	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1
url:	http://demo.fwanalyzer.com/	Trust: 0.1
url:	http://127.0.0.1/fw/index2.do?completedata=true&url=importedlogdetails"	Trust: 0.1
url:	http://127.0.0.1/fw/mindex.do?url=./web-inf/web.xml%3f	Trust: 0.1
url:	http://127.0.0.1/fw/index2.do?helpp=fim&link=0&sel=13&tab=system&url=./web-inf/web.xml%3f	Trust: 0.1
url:	https://www.signal-net.net)	Trust: 0.1
url:	http://127.0.0.1/fw/index2.do?completedata=true&helpp=archiveaction&tab=system&url=./web-inf/web.xml%3f	Trust: 0.1
url:	http://www.manageengine.com/products/firewall/	Trust: 0.1

sources: VULHUB: VHN-58172 // JVNDB: JVNDB-2012-004281 // PACKETSTORM: 111465 // PACKETSTORM: 130169 // CNNVD: CNNVD-201209-209 // NVD: CVE-2012-4891

CREDITS

Unknown

Trust: 0.3

sources: BID: 73625

SOURCES

db:	VULHUB	id:	VHN-58172
db:	BID	id:	73625
db:	JVNDB	id:	JVNDB-2012-004281
db:	PACKETSTORM	id:	111465
db:	PACKETSTORM	id:	130169
db:	CNNVD	id:	CNNVD-201209-209
db:	NVD	id:	CVE-2012-4891

LAST UPDATE DATE

2025-04-11T22:56:08.263000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-58172	date:	2017-08-29T00:00:00
db:	BID	id:	73625	date:	2012-09-10T00:00:00
db:	JVNDB	id:	JVNDB-2012-004281	date:	2012-09-12T00:00:00
db:	CNNVD	id:	CNNVD-201209-209	date:	2012-09-14T00:00:00
db:	NVD	id:	CVE-2012-4891	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-58172	date:	2012-09-10T00:00:00
db:	BID	id:	73625	date:	2012-09-10T00:00:00
db:	JVNDB	id:	JVNDB-2012-004281	date:	2012-09-12T00:00:00
db:	PACKETSTORM	id:	111465	date:	2012-04-02T05:26:26
db:	PACKETSTORM	id:	130169	date:	2015-01-29T18:35:47
db:	CNNVD	id:	CNNVD-201209-209	date:	2012-09-14T00:00:00
db:	NVD	id:	CVE-2012-4891	date:	2012-09-10T22:55:07.587