6.1

CVE-2019-8346

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5000
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5001
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5002
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5010
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5011
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5020
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5021
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5022
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5030
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5032
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5040
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5041
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5100
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5101
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5102
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5103
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5104
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5105
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5106
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5107
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5108
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5109
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5110
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5111
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5112
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5113
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5114
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5115
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5200
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5201
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5202
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5203
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5204
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5205
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5206
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5207
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5300
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5301
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5302
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5303
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5304
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5305
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5306
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5307
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5308
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5309
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5310
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5311
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5312
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5313
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5314
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5315
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5316
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5317
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5318
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5319
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5320
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5321
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5322
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5323
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5324
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5325
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5326
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5327
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5328
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5329
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5330
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.4 Update 5400
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5500
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5501
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5502
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5503
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5504
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5505
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5506
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5507
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5508
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5509
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5510
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5511
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5512
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5513
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5514
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5515
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5516
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5517
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5518
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5519
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5520
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5521
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5600
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5601
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5602
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5603
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5604
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5605
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5606
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5607
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.7 Update 5702
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.7 Update 5704
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.5% 0.876
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.manageengine.com/products/self-service-password/release-notes.html
Vendor Advisory
Release Notes