ManageEngine OpManager Stored Cross-Site Scripting Vulnerability in SNMP Trap Processor

A stored cross-site scripting vulnerability has been identified in ManageEngine OpManager, OpManager Enterprise Edition, OpManager Plus, OpManager Plus Enterprise Edition, and OpManager MSP, all versions through 128609. The vulnerability resides in the SNMP Trap Processor module, where a user with permission to modify the processor can inject malicious JavaScript into the Description field. This injected script executes when an admin views the SNMP Trap Processors page, potentially allowing the attacker to use the admin's CSRF token and session to gain a reverse shell and execute remote code on the server.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, with the injected script executing in the context of an admin user. This could lead to a reverse shell and remote code execution on the server.

Remediation

Users can upgrade to version 128610 or later. Instructions for downloading the latest upgrade pack are available on the ManageEngine website.