ManageEngine Products Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils, affecting versions prior to 128582. The vulnerability resides in the Subnet Details section, where authenticated, low-privileged users with permission to modify subnet information can inject malicious JavaScript payloads. These injected scripts are stored and executed when other users access the affected page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the Subnet Details page.

Remediation

Users can upgrade to version 128582, 128570, or 128465. Instructions for downloading the latest upgrade pack are available on the ManageEngine website.