PT-2023-21664 · Zoho · Zoho Manageengine Applications Manager

Rahul Maini · Publicado 2023-04-11 · Atualizado 2023-04-14 · CVE-2023-28341

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions through 16340

Description A stored Cross site scripting (XSS) issue allows an unauthenticated user to inject malicious javascript on the incorrect login details page. This can be exploited by injecting malicious code into the login page, potentially affecting user sessions.

Recommendations For versions through 16340, update to a version that includes a fix for this issue to prevent malicious javascript injection. As a temporary workaround, consider restricting access to the login page to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-28341

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-28341 · Nota de Segurança
• https://t.me/cibsecurity/61834 · Publicação no Telegram
• https://t.me/cvenotify/47978 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28341 · Aviso do Fabricante
• https://manageengine.com · Nota
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-28341.html · Aviso do Fabricante