PT-2011-1396 · Zoho · Zoho Manageengine Adselfservice Plus

Ernesto Alvarez · Published 2011-02-17 · Updated 2018-10-10 · CVE-2010-3274

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine ADSelfService Plus versions prior to 4.5 Build 4500

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Employee Search Engine of ZOHO ManageEngine ADSelfService Plus. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in specific actions, including showList and Search actions.

Recommendations For versions prior to 4.5 Build 4500, update to version 4.5 Build 4500 or later to resolve the issue. As a temporary workaround, consider restricting access to the Employee Search Engine or avoiding the use of the searchString parameter in the affected actions until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-3274

Affected Products

Zoho Manageengine Adselfservice Plus

References · 12

• 🔥 http://osvdb.org/70871 · Exploit
• 🔥 https://exploit-db.com/exploits/35331 · Exploit
• 🔥 http://coresecurity.com/content/zoho-manageengine-vulnerabilities · Exploit
• 🔥 http://osvdb.org/70872 · Exploit
• 🔥 http://securityfocus.com/bid/46331 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-3274 · Security Note
• http://vupen.com/english/advisories/2011/0392 · Vendor Advisory
• http://secunia.com/advisories/43241 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3274 · Note
• http://securityfocus.com/archive/1/516396/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65349 · Note
• http://securityreason.com/securityalert/8089 · Note