[email protected]CVE-2018-20485

HistoryDec 26, 2018 - 6:29 p.m.

CVE-2018-20485

2018-12-2618:29:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2018-20485

zoho manageengine

adselfservice plus

xss

employee search

security vulnerability

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

50.9%

JSON

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.

CPENameOperatorVersion
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.7
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.0
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.1
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.2
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.3
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.4
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.5
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.6
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq4.5

CPE	Name	Operator	Version
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.7
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.0
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.1
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.2
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.3
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.4
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.5
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.6
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	4.5

References

packetstormsecurity.com/files/152793/Zoho-ManageEngine-ADSelfService-Plus-5.7-Cross-Site-Scripting.html

www.manageengine.com/products/self-service-password/release-notes.html

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

50.9%

JSON

Related for CVE-2018-20485

cvelist1 prion1 packetstorm1 exploitpack1 zdt1 exploitdb1