PT-2019-18979 · Zoho · Zoho Manageengine Adselfservice Plus

Publicado 2019-05-24 · Atualizado 2019-05-29 · CVE-2019-8346

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 5.x through 5704

Description The issue allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf in the authorization.do endpoint. This can be used to capture a user's AD self-service password reset and MFA token.

Recommendations For versions 5.x through 5704, consider restricting access to the authorization.do endpoint until a patch is available. As a temporary workaround, avoid using the adscsrf parameter in the affected endpoint to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-8346

Produtos afetados

Zoho Manageengine Adselfservice Plus

Referências · 3

• https://manageengine.com/products/self-service-password/release-notes.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8346 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-8346 · Aviso do Fabricante