Lucene search

MitreCVE-2018-9163

HistoryApr 02, 2018 - 12:29 p.m.

CVE-2018-9163

2018-04-0212:29:00

CWE-79

mitre

web.nvd.nist.gov

cve-2018-9163

stored xss

zoho

manageengine

recovery manager plus

security vulnerability

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.874

Percentile

98.7%

JSON

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.

Affected configurations

Nvd

Node

zohocorpmanageengine_recovery_manager_plusRange<5.3

VendorProductVersionCPE
zohocorpmanageengine_recovery_manager_plus*cpe:2.3:a:zohocorp:manageengine_recovery_manager_plus:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_recovery_manager_plus	*	cpe:2.3:a:zohocorp:manageengine_recovery_manager_plus::::::::

References

www.securityfocus.com/bid/103773

gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/

www.exploit-db.com/exploits/44666/

www.manageengine.com/ad-recovery-manager/release-notes.html#5350

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.874

Percentile

98.7%

JSON

Related for CVE-2018-9163