Sign-up

ID

VAR-201905-0976


CVE

CVE-2019-11676


TITLE

Zoho ManageEngine Firewall Analyzer Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2019-004014

DESCRIPTION

The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks. Zoho ManageEngine Firewall Analyzer Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Zoho ManageEngine Firewall Analyzer is prone to the following security vulnerabilities. 1. An HTML-injection vulnerability. 2. An XML External Entity injection vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or gain access to sensitive information or cause denial-of-service conditions. Other attacks are also possible. ZOHO ManageEngine Firewall Analyzer is a set of web-based firewall log analysis tools from ZOHO, USA. It can collect, correlate analysis and report logs on firewalls, proxy servers and Radius servers throughout the enterprise. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

Trust: 1.98

sources: NVD: CVE-2019-11676 // JVNDB: JVNDB-2019-004014 // BID: 108841 // VULHUB: VHN-143346

AFFECTED PRODUCTS

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:7.4

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:8.5

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:8.1

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:8.3

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:12.0

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:12.2

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:7.6

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:12.3

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:7.2

Trust: 1.0

vendor:zohocorpmodel:manageengine firewall analyzerscope:eqversion:8.0

Trust: 1.0

vendor:zohomodel:manageengine firewall analyzerscope:ltversion:12.3 build 123224

Trust: 0.8

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:8.58500

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:8.38300

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:8.18110

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:8.08000

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:7.67600

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:7.47400

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:7.27021

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:7.27020

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123223

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123222

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123218

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123208

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123197

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123194

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123186

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123185

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123182

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123177

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123169

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123164

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123156

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123151

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123137

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123129

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123126

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123092

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123083

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123070

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123064

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123057

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123045

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123027

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.3123008

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.312300

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.212200

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:eqversion:12.012000

Trust: 0.3

vendor:zohomodel:manageengine firewall analyzer buildscope:neversion:12.3123224

Trust: 0.3

sources: BID: 108841 // JVNDB: JVNDB-2019-004014 // NVD: CVE-2019-11676

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-11676
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-11676
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201905-068
value: MEDIUM

Trust: 0.6

VULHUB: VHN-143346
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-11676
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-143346
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-11676
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-143346 // JVNDB: JVNDB-2019-004014 // CNNVD: CNNVD-201905-068 // NVD: CVE-2019-11676

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-143346 // JVNDB: JVNDB-2019-004014 // NVD: CVE-2019-11676

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201905-068

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201905-068

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-004014

PATCH
title:Firewall Analyzer - Release Notesurl:https://www.manageengine.com/products/firewall/release-notes.html
Trust: 0.8
title:ZOHO ManageEngine Firewall Analyzer Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=92208
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-004014 // 
            
            
            
            CNNVD: CNNVD-201905-068

EXTERNAL IDS
db:NVDid:CVE-2019-11676
Trust: 2.8
db:JVNDBid:JVNDB-2019-004014
Trust: 0.8
db:CNNVDid:CNNVD-201905-068
Trust: 0.7
db:BIDid:108841
Trust: 0.3
db:VULHUBid:VHN-143346
Trust: 0.1
sources:
            
            
            VULHUB: VHN-143346 // 
            
            
            
            BID: 108841 // 
            
            
            
            JVNDB: JVNDB-2019-004014 // 
            
            
            
            CNNVD: CNNVD-201905-068 // 
            
            
            
            NVD: CVE-2019-11676

REFERENCES
url:https://www.manageengine.com/products/firewall/release-notes.html
Trust: 2.0
url:https://nvd.nist.gov/vuln/detail/cve-2019-11676
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11676
Trust: 0.8
url:https://www.manageengine.com/products/firewall/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-143346 // 
            
            
            
            BID: 108841 // 
            
            
            
            JVNDB: JVNDB-2019-004014 // 
            
            
            
            CNNVD: CNNVD-201905-068 // 
            
            
            
            NVD: CVE-2019-11676

CREDITS
The vendor reported these issues.
Trust: 0.3
sources:
            
            
            BID: 108841

SOURCES
db:VULHUBid:VHN-143346
db:BIDid:108841
db:JVNDBid:JVNDB-2019-004014
db:CNNVDid:CNNVD-201905-068
db:NVDid:CVE-2019-11676

LAST UPDATE DATE
2024-11-23T22:21:37.252000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-143346date:2019-05-03T00:00:00
db:BIDid:108841date:2019-05-02T00:00:00
db:JVNDBid:JVNDB-2019-004014date:2019-05-27T00:00:00
db:CNNVDid:CNNVD-201905-068date:2019-05-08T00:00:00
db:NVDid:CVE-2019-11676date:2024-11-21T04:21:34.310

SOURCES RELEASE DATE
db:VULHUBid:VHN-143346date:2019-05-02T00:00:00
db:BIDid:108841date:2019-05-02T00:00:00
db:JVNDBid:JVNDB-2019-004014date:2019-05-27T00:00:00
db:CNNVDid:CNNVD-201905-068date:2019-05-02T00:00:00
db:NVDid:CVE-2019-11676date:2019-05-02T14:29:00.307