ID de Prueba:	1.3.6.1.4.1.25623.1.0.805103
Categoría:	Web application abuses
Título:	ManageEngine OpManager Multiple Vulnerabilities (Nov 2014) - Active Check
Resumen:	ManageEngine OpManager is prone to multiple vulnerabilities.
Descripción:	Summary: ManageEngine OpManager is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - /servlet/MigrateLEEData script not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') supplied via the 'fileName' parameter. - /servlet/MigrateCentralData script not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') supplied via the 'zipFileName' parameter. - /servlet/APMBVHandler script not properly sanitizing user-supplied input to the 'OPM_BVNAME' POST parameter. - /servlet/DataComparisonServlet script not properly sanitizing user-supplied input to the 'query' POST parameter. Vulnerability Impact: Successful exploitation will allow attackers to upload arbitrary files and execute the script within the file with the privileges of the web server, manipulate SQL queries in the backend database, and disclose certain sensitive information. Affected Software/OS: ManageEngine OpManager version 11.3/11.4. Solution: Apply the patches from the referenced links. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-7866 Bugtraq: 20141109 [The ManageOwnage series, part VIII]: Remote code execution and blind SQLi in OpManager, Social IT and IT360 (Google Search) http://www.securityfocus.com/archive/1/533946/100/0/threaded http://seclists.org/fulldisclosure/2014/Nov/21 http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt Common Vulnerability Exposure (CVE) ID: CVE-2014-7868 BugTraq ID: 71002 http://www.securityfocus.com/bid/71002 Common Vulnerability Exposure (CVE) ID: CVE-2014-6035 http://seclists.org/fulldisclosure/2014/Sep/110
Copyright	Copyright (C) 2014 Greenbone Networks GmbH

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.