PT-2023-7071 · Zoho · Zoho Manageengine Applications Manager

Publicado 2023-08-10 · Atualizado 2025-03-07 · CVE-2023-38333

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions through 16530

Description The issue is related to the failure to protect the web page structure, allowing a remote attacker to conduct a cross-site scripting attack and execute arbitrary code. This can be achieved through reflected XSS while logged in. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions through 16530, update to a version that includes the fix for this issue to prevent reflected XSS attacks. As a temporary workaround, consider restricting access to sensitive features or pages that may be vulnerable to cross-site scripting attacks until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-08096

CVE-2023-38333

ZDI-23-1715

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 10

• https://osv.dev/vulnerability/CVE-2023-38333 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-08096 · Nota de Segurança
• https://t.me/cibsecurity/68249 · Publicação no Telegram
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-38333.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38333 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-23-1715 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-CAN-21226 · Nota
• https://twitter.com/VulmonFeeds/status/1689766880154673152 · Publicação no Twitter
• https://t.me/cvenotify/113899 · Publicação no Telegram
• https://vuldb.com/es/?id.236917 · Nota