Unscored severity · published Dec 22, 2009
CVE-2009-4387
The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for…
–
CVSS
1.3%
EPSS
No
On KEV
Description
The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for malicious inputs, which allows remote attackers to inject arbitrary web script or HTML via the searchtext parameter and other unspecified inputs.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Password Manager Pro · Manageengine
through 6.1; through 6.1; 4.6; 4.7; 4.8; 5.0; +5 more · source: NVD
PM
Password Manager Pro6.1 · Manageengine
through - · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-4387
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-4387
forums.manageengine.com
http://forums.manageengine.com/#Topic/49000003740390
Vendor Advisory
http://secunia.com/advisories/37765
Patch
http://www.manageengine.com/products/passwordmanagerpro/release-notes.html
Patch
http://www.scip.ch/?vuldb.4063
Exploit
http://www.scip.ch/publikationen/advisories/scip_advisory-4063_manageengine_pmp_script_injection.txt
www.securityfocus.com
http://www.securityfocus.com/bid/37336
More from Password Manager Pro
8.8
CVE-2024-5546
SQL Injection
–
CVE-2014-9372
Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remote attackers to delete arbitrary files…
–
CVE-2014-3996
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build…
–
CVE-2014-8499
Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow…