Lucene search

[email protected]CVE-2019-8346

HistoryMay 24, 2019 - 5:29 p.m.

CVE-2019-8346

2019-05-2417:29:06

CWE-79

[email protected]

web.nvd.nist.gov

zoho

manageengine

adselfservice plus

xss

vulnerability

cve-2019-8346

nvd

security

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

49.4%

JSON

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user’s AD self-service password reset and MFA token.

Affected configurations

NVD

Node

zohocorpmanageengine_adselfservice_plusMatch5.05000

zohocorpmanageengine_adselfservice_plusMatch5.05001

zohocorpmanageengine_adselfservice_plusMatch5.05002

zohocorpmanageengine_adselfservice_plusMatch5.05010

zohocorpmanageengine_adselfservice_plusMatch5.05011

zohocorpmanageengine_adselfservice_plusMatch5.05020

zohocorpmanageengine_adselfservice_plusMatch5.05021

zohocorpmanageengine_adselfservice_plusMatch5.05022

zohocorpmanageengine_adselfservice_plusMatch5.05030

zohocorpmanageengine_adselfservice_plusMatch5.05032

zohocorpmanageengine_adselfservice_plusMatch5.05040

zohocorpmanageengine_adselfservice_plusMatch5.05041

zohocorpmanageengine_adselfservice_plusMatch5.15100

zohocorpmanageengine_adselfservice_plusMatch5.15101

zohocorpmanageengine_adselfservice_plusMatch5.15102

zohocorpmanageengine_adselfservice_plusMatch5.15103

zohocorpmanageengine_adselfservice_plusMatch5.15104

zohocorpmanageengine_adselfservice_plusMatch5.15105

zohocorpmanageengine_adselfservice_plusMatch5.15106

zohocorpmanageengine_adselfservice_plusMatch5.15107

zohocorpmanageengine_adselfservice_plusMatch5.15108

zohocorpmanageengine_adselfservice_plusMatch5.15109

zohocorpmanageengine_adselfservice_plusMatch5.15110

zohocorpmanageengine_adselfservice_plusMatch5.15111

zohocorpmanageengine_adselfservice_plusMatch5.15112

zohocorpmanageengine_adselfservice_plusMatch5.15113

zohocorpmanageengine_adselfservice_plusMatch5.15114

zohocorpmanageengine_adselfservice_plusMatch5.15115

zohocorpmanageengine_adselfservice_plusMatch5.25200

zohocorpmanageengine_adselfservice_plusMatch5.25201

zohocorpmanageengine_adselfservice_plusMatch5.25202

zohocorpmanageengine_adselfservice_plusMatch5.25203

zohocorpmanageengine_adselfservice_plusMatch5.25204

zohocorpmanageengine_adselfservice_plusMatch5.25205

zohocorpmanageengine_adselfservice_plusMatch5.25206

zohocorpmanageengine_adselfservice_plusMatch5.25207

zohocorpmanageengine_adselfservice_plusMatch5.35300

zohocorpmanageengine_adselfservice_plusMatch5.35301

zohocorpmanageengine_adselfservice_plusMatch5.35302

zohocorpmanageengine_adselfservice_plusMatch5.35303

zohocorpmanageengine_adselfservice_plusMatch5.35304

zohocorpmanageengine_adselfservice_plusMatch5.35305

zohocorpmanageengine_adselfservice_plusMatch5.35306

zohocorpmanageengine_adselfservice_plusMatch5.35307

zohocorpmanageengine_adselfservice_plusMatch5.35308

zohocorpmanageengine_adselfservice_plusMatch5.35309

zohocorpmanageengine_adselfservice_plusMatch5.35310

zohocorpmanageengine_adselfservice_plusMatch5.35311

zohocorpmanageengine_adselfservice_plusMatch5.35312

zohocorpmanageengine_adselfservice_plusMatch5.35313

zohocorpmanageengine_adselfservice_plusMatch5.35314

zohocorpmanageengine_adselfservice_plusMatch5.35315

zohocorpmanageengine_adselfservice_plusMatch5.35316

zohocorpmanageengine_adselfservice_plusMatch5.35317

zohocorpmanageengine_adselfservice_plusMatch5.35318

zohocorpmanageengine_adselfservice_plusMatch5.35319

zohocorpmanageengine_adselfservice_plusMatch5.35320

zohocorpmanageengine_adselfservice_plusMatch5.35321

zohocorpmanageengine_adselfservice_plusMatch5.35322

zohocorpmanageengine_adselfservice_plusMatch5.35323

zohocorpmanageengine_adselfservice_plusMatch5.35324

zohocorpmanageengine_adselfservice_plusMatch5.35325

zohocorpmanageengine_adselfservice_plusMatch5.35326

zohocorpmanageengine_adselfservice_plusMatch5.35327

zohocorpmanageengine_adselfservice_plusMatch5.35328

zohocorpmanageengine_adselfservice_plusMatch5.35329

zohocorpmanageengine_adselfservice_plusMatch5.35330

zohocorpmanageengine_adselfservice_plusMatch5.45400

zohocorpmanageengine_adselfservice_plusMatch5.55500

zohocorpmanageengine_adselfservice_plusMatch5.55501

zohocorpmanageengine_adselfservice_plusMatch5.55502

zohocorpmanageengine_adselfservice_plusMatch5.55503

zohocorpmanageengine_adselfservice_plusMatch5.55504

zohocorpmanageengine_adselfservice_plusMatch5.55505

zohocorpmanageengine_adselfservice_plusMatch5.55506

zohocorpmanageengine_adselfservice_plusMatch5.55507

zohocorpmanageengine_adselfservice_plusMatch5.55508

zohocorpmanageengine_adselfservice_plusMatch5.55509

zohocorpmanageengine_adselfservice_plusMatch5.55510

zohocorpmanageengine_adselfservice_plusMatch5.55511

zohocorpmanageengine_adselfservice_plusMatch5.55512

zohocorpmanageengine_adselfservice_plusMatch5.55513

zohocorpmanageengine_adselfservice_plusMatch5.55514

zohocorpmanageengine_adselfservice_plusMatch5.55515

zohocorpmanageengine_adselfservice_plusMatch5.55516

zohocorpmanageengine_adselfservice_plusMatch5.55517

zohocorpmanageengine_adselfservice_plusMatch5.55518

zohocorpmanageengine_adselfservice_plusMatch5.55519

zohocorpmanageengine_adselfservice_plusMatch5.55520

zohocorpmanageengine_adselfservice_plusMatch5.55521

zohocorpmanageengine_adselfservice_plusMatch5.65600

zohocorpmanageengine_adselfservice_plusMatch5.65601

zohocorpmanageengine_adselfservice_plusMatch5.65602

zohocorpmanageengine_adselfservice_plusMatch5.65603

zohocorpmanageengine_adselfservice_plusMatch5.65604

zohocorpmanageengine_adselfservice_plusMatch5.65605

zohocorpmanageengine_adselfservice_plusMatch5.65606

zohocorpmanageengine_adselfservice_plusMatch5.65607

zohocorpmanageengine_adselfservice_plusMatch5.75702

zohocorpmanageengine_adselfservice_plusMatch5.75704

CPENameOperatorVersion
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.0
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.1
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.2
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.3
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.4
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.5
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.6
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.7

CPE	Name	Operator	Version
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.0
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.1
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.2
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.3
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.4
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.5
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.6
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.7

References

www.manageengine.com/products/self-service-password/release-notes.html

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

49.4%

JSON

Related for CVE-2019-8346

prion1 nvd1 cvelist1