peter bassill · operator
$ cve CVE-2012-4889 JSON

CVE-2012-4889 EXPLOIT

4.3
MEDIUM · CVSS 2.0 · EPSS 7.7% (pctl 94)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2) tab parameter to createAnomaly.do; (3) url, (4) subTab, or (5) tab parameter to mindex.do; (6) tab parameter to index2.do; or (7) port parameter to syslogViewer.do.

Scoring

CVSS4.3 (MEDIUM, v2.0)
VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS7.72% — more likely to be exploited than 94% of all CVEs
WeaknessCWE-79
On CISA KEVno
Public exploityes
Published2012-09-10
Last modified2026-06-16

Affected (1)

VendorProduct
manageenginefirewall analyzer

Public exploits

SourceTitleDate
exploit-dbManageEngine Firewall Analyzer 8.0 - Directory Traversal / Cross-Site Scripting2015-01-29
exploit-dbManageEngine Firewall Analyzer 7.2 - '/fw/index2.do' Multiple Cross-Site Scripting Vulnerabilities2012-04-01
exploit-dbManageEngine Firewall Analyzer 7.2 - 'fw/createAnomaly.do?subTab' Cross-Site Scripting2012-04-01
exploit-dbManageEngine Firewall Analyzer 7.2 - 'fw/mindex.do?url' Cross-Site Scripting2012-04-01
exploit-dbManageEngine Firewall Analyzer 7.2 - 'fw/syslogViewer.do?port' Cross-Site Scripting2012-04-01

References

→ the Explorer  ·  watch your stack  ·  NVD