Secunia

Jason Rhodes has discovered a vulnerability in ManageEngine OpUtils, which can be exploited by malicious users to conduct script insertion attacks.

Input passed to the "hostName" parameter in MainLayout.do when e.g. viewing an SNMP graph is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when e.g. using the SNMP Graph tool.

The vulnerability is confirmed in version 5. Other versions may also be affected.

Solution
The vendor will reportedly fix this in an upcoming update.
Further details available in Customer Area

Provided and/or discovered by
Jason Rhodes

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area