What’s Vulnerable › Vulnerabilities

CVE-2024-38870: Stored XSS

• Severity: low (CVSS 3.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-17 · updated 2026-06-17
• Weakness: CWE-79

Description

Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module.

Affected products

• ManageEngine OpManager, OpManager Plus, OpManager MSP, OpManager Enterprise Edition: before 128104; from 128151 before 128238; from 128247 before 128250 — fixed in 128104, 128238, 128250

How to fix

Upgrade to a fixed version: ManageEngine OpManager, OpManager Plus, OpManager MSP, OpManager Enterprise Edition 128104, 128238, 128250. Check the vendor advisory for mitigations.

References

• https://www.manageengine.com/network-monitoring/security-updates/cve-2024-38870.html
• https://www.manageengine.com/network-monitoring/security-updates/cve-2024-38870.html

Get alerted when CVE-2024-38870 or the next vulnerability affects your stack