Lucene search

[email protected]CVE-2020-27449

HistoryAug 11, 2023 - 2:15 p.m.

CVE-2020-27449

2023-08-1114:15:10

CWE-79

[email protected]

web.nvd.nist.gov

cve

2020

27449

cross site scripting

xss

query report

zoho manageengine

password manager pro

remote attack

arbitrary code

javascript payload

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.8%

JSON

Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload.

Affected configurations

NVD

Node

zohocorpmanageengine_password_manager_proMatch11.1build_11101

CPENameOperatorVersion
zohocorp:manageengine_password_manager_prozohocorp manageengine password manager proeq11.1

CPE	Name	Operator	Version
zohocorp:manageengine_password_manager_pro	zohocorp manageengine password manager pro	eq	11.1

References

bugbounty.zoho.com/bb/#/bug/101000003619211

www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.8%

JSON

Related for CVE-2020-27449

prion1 nvd1 cvelist1