6.1

CVE-2022-24681

Exploit
Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update -
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6100
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6101
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6102
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6103
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6104
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6105
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6106
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6107
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6108
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6109
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6110
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6111
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6112
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6113
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6114
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6115
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6116
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6117
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6118
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6119
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6120
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.62% 0.88
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://manageengine.com
Product
https://raxis.com/blog/cve-2022-24681
Patch
Third Party Advisory
Exploit
https://www.manageengine.com/products/self-service-password/kb/CVE-2022-24681.html
Patch
Vendor Advisory