CVE-2012-1062 - CVE House

Back to Database

Status published Medium CVE-2012-1062

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x...

4.3 CVSS

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-1062

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from manageengine

View All →

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command...

Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174...

Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the...

The FileUploadServlet class in ManageEngine Desktop Central 9 before build...

ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows...

Affected Vendor

manageengine

View all reports →

Affected Software

applications manager

Vulnerable Versions:

10.0, 10.1, 10.2, 10.3, 9, 9.1, 9.2, 9.3, 9.4, 9.5

Timeline

Official Publish: February 14th, 2012

Last Modified: August 6th, 2024

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.