Vulnerability · Published Jul 17, 2024 · Assigned by ManageEngine
CVE-2024-38870Stored XSS
Low 3.5
In plain English
A low-severity cross-site scripting in OpManager, OpManager Plus, OpManager MSP, OpManager Enterprise Edition from ManageEngine. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.3%top 79.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ManageEngine | OpManager, OpManager Plus, OpManager MSP, OpManager Enterprise Edition | 0 – before 128104128151 – before 128238128247 – before 128250 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N