CVE-2018-10803

MEDIUM

ManageEngine NetFlow Analyzer 12.3-12.3.125 - Stored Cross-Site Scripting via Credential Description

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/104251

Vendor Advisory x_refsource_confirm

https://www.manageengine.com/products/netflow/readme.html#123125

Scores

CVSS v3 6.1

EPSS 0.0027

EPSS Percentile 50.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-352 CWE-79

Status published

Products (1)

zohocorp/manageengine_netflow_analyzer 12.3 - 12.3.125

Published May 10, 2018

Tracked Since Feb 18, 2026