PT-2011-1396 · Zoho · Zoho Manageengine Adselfservice Plus

Ernesto Alvarez · Publicado 2011-02-17 · Atualizado 2018-10-10 · CVE-2010-3274

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine ADSelfService Plus versions prior to 4.5 Build 4500

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Employee Search Engine of ZOHO ManageEngine ADSelfService Plus. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in specific actions, including showList and Search actions.

Recommendations For versions prior to 4.5 Build 4500, update to version 4.5 Build 4500 or later to resolve the issue. As a temporary workaround, consider restricting access to the Employee Search Engine or avoiding the use of the searchString parameter in the affected actions until the update is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-3274

Produtos afetados

Zoho Manageengine Adselfservice Plus

Referências · 12

• 🔥 http://osvdb.org/70871 · Exploit
• 🔥 https://exploit-db.com/exploits/35331 · Exploit
• 🔥 http://coresecurity.com/content/zoho-manageengine-vulnerabilities · Exploit
• 🔥 http://osvdb.org/70872 · Exploit
• 🔥 http://securityfocus.com/bid/46331 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3274 · Nota
• http://securityfocus.com/archive/1/516396/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65349 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3274 · Nota de Segurança
• http://securityreason.com/securityalert/8089 · Nota
• http://vupen.com/english/advisories/2011/0392 · Aviso do Fabricante
• http://secunia.com/advisories/43241 · Aviso do Fabricante