Lucene search

MitreCVE-2018-20484

HistoryDec 26, 2018 - 6:29 p.m.

CVE-2018-20484

2018-12-2618:29:00

CWE-79

mitre

web.nvd.nist.gov

cve-2018-20484

zoho

manageengine

adselfservice plus

xss

self-update

layout

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

51.2%

JSON

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.

Affected configurations

Nvd

Node

zohocorpmanageengine_adselfservice_plusMatch5.74500

zohocorpmanageengine_adselfservice_plusMatch5.75032

zohocorpmanageengine_adselfservice_plusMatch5.75040

zohocorpmanageengine_adselfservice_plusMatch5.75041

zohocorpmanageengine_adselfservice_plusMatch5.75100

zohocorpmanageengine_adselfservice_plusMatch5.75101

zohocorpmanageengine_adselfservice_plusMatch5.75102

zohocorpmanageengine_adselfservice_plusMatch5.75103

zohocorpmanageengine_adselfservice_plusMatch5.75104

zohocorpmanageengine_adselfservice_plusMatch5.75105

zohocorpmanageengine_adselfservice_plusMatch5.75106

zohocorpmanageengine_adselfservice_plusMatch5.75107

zohocorpmanageengine_adselfservice_plusMatch5.75108

zohocorpmanageengine_adselfservice_plusMatch5.75109

zohocorpmanageengine_adselfservice_plusMatch5.75110

zohocorpmanageengine_adselfservice_plusMatch5.75111

zohocorpmanageengine_adselfservice_plusMatch5.75112

zohocorpmanageengine_adselfservice_plusMatch5.75113

zohocorpmanageengine_adselfservice_plusMatch5.75114

zohocorpmanageengine_adselfservice_plusMatch5.75115

zohocorpmanageengine_adselfservice_plusMatch5.75116

zohocorpmanageengine_adselfservice_plusMatch5.75200

zohocorpmanageengine_adselfservice_plusMatch5.75201

zohocorpmanageengine_adselfservice_plusMatch5.75202

zohocorpmanageengine_adselfservice_plusMatch5.75203

zohocorpmanageengine_adselfservice_plusMatch5.75204

zohocorpmanageengine_adselfservice_plusMatch5.75205

zohocorpmanageengine_adselfservice_plusMatch5.75206

zohocorpmanageengine_adselfservice_plusMatch5.75207

zohocorpmanageengine_adselfservice_plusMatch5.75300

zohocorpmanageengine_adselfservice_plusMatch5.75301

zohocorpmanageengine_adselfservice_plusMatch5.75302

zohocorpmanageengine_adselfservice_plusMatch5.75303

zohocorpmanageengine_adselfservice_plusMatch5.75304

zohocorpmanageengine_adselfservice_plusMatch5.75305

zohocorpmanageengine_adselfservice_plusMatch5.75306

zohocorpmanageengine_adselfservice_plusMatch5.75307

zohocorpmanageengine_adselfservice_plusMatch5.75308

zohocorpmanageengine_adselfservice_plusMatch5.75309

zohocorpmanageengine_adselfservice_plusMatch5.75310

zohocorpmanageengine_adselfservice_plusMatch5.75311

zohocorpmanageengine_adselfservice_plusMatch5.75312

zohocorpmanageengine_adselfservice_plusMatch5.75313

zohocorpmanageengine_adselfservice_plusMatch5.75314

zohocorpmanageengine_adselfservice_plusMatch5.75315

zohocorpmanageengine_adselfservice_plusMatch5.75316

zohocorpmanageengine_adselfservice_plusMatch5.75317

zohocorpmanageengine_adselfservice_plusMatch5.75318

zohocorpmanageengine_adselfservice_plusMatch5.75319

zohocorpmanageengine_adselfservice_plusMatch5.75320

zohocorpmanageengine_adselfservice_plusMatch5.75321

zohocorpmanageengine_adselfservice_plusMatch5.75322

zohocorpmanageengine_adselfservice_plusMatch5.75323

zohocorpmanageengine_adselfservice_plusMatch5.75324

zohocorpmanageengine_adselfservice_plusMatch5.75325

zohocorpmanageengine_adselfservice_plusMatch5.75326

zohocorpmanageengine_adselfservice_plusMatch5.75327

zohocorpmanageengine_adselfservice_plusMatch5.75328

zohocorpmanageengine_adselfservice_plusMatch5.75329

zohocorpmanageengine_adselfservice_plusMatch5.75330

zohocorpmanageengine_adselfservice_plusMatch5.75400

zohocorpmanageengine_adselfservice_plusMatch5.75500

zohocorpmanageengine_adselfservice_plusMatch5.75501

zohocorpmanageengine_adselfservice_plusMatch5.75502

zohocorpmanageengine_adselfservice_plusMatch5.75503

zohocorpmanageengine_adselfservice_plusMatch5.75504

zohocorpmanageengine_adselfservice_plusMatch5.75505

zohocorpmanageengine_adselfservice_plusMatch5.75506

zohocorpmanageengine_adselfservice_plusMatch5.75507

zohocorpmanageengine_adselfservice_plusMatch5.75508

zohocorpmanageengine_adselfservice_plusMatch5.75509

zohocorpmanageengine_adselfservice_plusMatch5.75510

zohocorpmanageengine_adselfservice_plusMatch5.75511

zohocorpmanageengine_adselfservice_plusMatch5.75512

zohocorpmanageengine_adselfservice_plusMatch5.75513

zohocorpmanageengine_adselfservice_plusMatch5.75514

zohocorpmanageengine_adselfservice_plusMatch5.75515

zohocorpmanageengine_adselfservice_plusMatch5.75516

zohocorpmanageengine_adselfservice_plusMatch5.75517

zohocorpmanageengine_adselfservice_plusMatch5.75518

zohocorpmanageengine_adselfservice_plusMatch5.75519

zohocorpmanageengine_adselfservice_plusMatch5.75520

zohocorpmanageengine_adselfservice_plusMatch5.75521

zohocorpmanageengine_adselfservice_plusMatch5.75600

zohocorpmanageengine_adselfservice_plusMatch5.75601

zohocorpmanageengine_adselfservice_plusMatch5.75602

zohocorpmanageengine_adselfservice_plusMatch5.75603

zohocorpmanageengine_adselfservice_plusMatch5.75604

zohocorpmanageengine_adselfservice_plusMatch5.75605

zohocorpmanageengine_adselfservice_plusMatch5.75606

zohocorpmanageengine_adselfservice_plusMatch5.75700

zohocorpmanageengine_adselfservice_plusMatch5.75701

VendorProductVersionCPE
zohocorpmanageengine_adselfservice_plus5.7cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:4500:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus5.7cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5032:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus5.7cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5040:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus5.7cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5041:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus5.7cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5100:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus5.7cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5101:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus5.7cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5102:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus5.7cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5103:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus5.7cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5104:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus5.7cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5105:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_adselfservice_plus	5.7	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:4500::::::
zohocorp	manageengine_adselfservice_plus	5.7	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5032::::::
zohocorp	manageengine_adselfservice_plus	5.7	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5040::::::
zohocorp	manageengine_adselfservice_plus	5.7	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5041::::::
zohocorp	manageengine_adselfservice_plus	5.7	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5100::::::
zohocorp	manageengine_adselfservice_plus	5.7	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5101::::::
zohocorp	manageengine_adselfservice_plus	5.7	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5102::::::
zohocorp	manageengine_adselfservice_plus	5.7	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5103::::::
zohocorp	manageengine_adselfservice_plus	5.7	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5104::::::
zohocorp	manageengine_adselfservice_plus	5.7	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5105::::::

Rows per page:

1-10 of 921

References

packetstormsecurity.com/files/152793/Zoho-ManageEngine-ADSelfService-Plus-5.7-Cross-Site-Scripting.html

www.manageengine.com/products/self-service-password/release-notes.html

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

51.2%

JSON

Related for CVE-2018-20484