CVE:CVE-2008-0474
CNNVD:CNNVD-200801-427
ManageEngine Applications Manager 8.1 build 8100中存在多个跨站脚本漏洞。远程攻击者可以借助以下几种方式注入任意的WEB脚本或HTML：(1)jsp/DiscoveryProfiles.jsp的 showlink参数,jsp/ThresholdActionConfiguration.jsp的(2)attributeIDs,(3)attributeToSelect,(4)redirectto,(5)resourceid参数,jsp/UpdateGlobalSettings.jsp的(6)page,(7)redirect参数,showTile.do的(8)haid以及(9)returnpath参数。
solution:Upgrade manageengine applications_manager to a higher version than 8.1_build_8100,and avoid the version 8.1_build_8100