PT-2023-11760 · Zoho · Manageengine Password Manager Pro

Publicado 2023-08-11 · Atualizado 2023-08-16 · CVE-2020-27449

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Password Manager Pro version 11001

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the Query Report feature, which allows remote attackers to execute arbitrary code and steal cookies via a crafted JavaScript payload.

Recommendations For Zoho ManageEngine Password Manager Pro version 11001, consider disabling the Query Report feature until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the Query Report feature to minimize the risk of arbitrary code execution and cookie theft. Avoid using the Query Report feature with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2020-27449

Produtos afetados

Manageengine Password Manager Pro

Referências · 6

• https://t.me/cvenotify/56271 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1690264158250385408 · Publicação no Twitter
• https://bugbounty.zoho.com/bb/#/bug/101000003619211 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2020-27449 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-27449 · Nota de Segurança
• https://manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002 · Nota