PT-2015-3736 · Zoho · Zoho Manageengine Adselfservice Plus

Published 2015-01-07 · Updated 2017-08-29 · CVE-2014-3779

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine ADSelfService Plus versions prior to 5.2 Build 5202

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the name parameter to "GroupSubscription.do" API endpoint.

Recommendations For versions prior to 5.2 Build 5202, update to version 5.2 Build 5202 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-3779

Affected Products

Zoho Manageengine Adselfservice Plus

References · 4

• 🔥 http://packetstormsecurity.com/files/129803/ADSelfservice-Plus-5.1-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3779 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3779 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99612 · Note