ID de Prueba:	1.3.6.1.4.1.25623.1.0.807677
Categoría:	Web application abuses
Título:	ManageEngine Password Manager Pro Multiple Vulnerabilities
Resumen:	ManageEngine Password Manager Pro is prone to multiple vulnerabilities.
Descripción:	Summary: ManageEngine Password Manager Pro is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws exist due to: - An improper sanitization of input to the parameter 'password' in 'AddMail.ve' script. - An improper sanitization of input to the parameters 'EMAIL', 'ROLE', 'OLDROLE' in 'EditUser.do' script. - An improper sanitization of input to the parameter 'Rule' in 'jsp/xmlhttp/AjaxResponse.jsp' script. - An improper sanitization of input to the parameters 'Resource' and 'Account' in '/jsp/xmlhttp/PasswdRetriveAjaxResponse.jsp.' script. - A Cross-Site Request Forgery vulnerability. Vulnerability Impact: Successful exploitation will allow remote attackers to execute arbitrary code, to escalate privileges, to bypass Password policy, to bypass Business Login, to do Password Bruteforce for resources accounts and to conduct request forgery attacks. Affected Software/OS: ManageEngine Password Manager Pro version 8.1 build 8102 to 8.3 build 8302 and probably earlier versions. Solution: Upgrade to ManageEngine Password Manager Pro version 8.3 build 8303 or later. CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Copyright	Copyright (C) 2016 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.