PT-2015-3736 · Zoho · Zoho Manageengine Adselfservice Plus

Publicado 2015-01-07 · Atualizado 2017-08-29 · CVE-2014-3779

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine ADSelfService Plus versions prior to 5.2 Build 5202

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the name parameter to "GroupSubscription.do" API endpoint.

Recommendations For versions prior to 5.2 Build 5202, update to version 5.2 Build 5202 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-3779

Produtos afetados

Zoho Manageengine Adselfservice Plus

Referências · 4

• 🔥 http://packetstormsecurity.com/files/129803/ADSelfservice-Plus-5.1-Cross-Site-Scripting.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3779 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3779 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99612 · Nota