PT-2018-18900 · Zoho · Zoho Manageengine Recovery Manager Plus

Ahmet Gürel · Published 2018-04-02 · Updated 2019-02-27 · CVE-2018-9163

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Recovery Manager Plus versions prior to 5.3 (Build 5350)

Description A stored Cross-site scripting (XSS) issue allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to the "technicianAction.do" endpoint.

Recommendations For versions prior to 5.3 (Build 5350), update to version 5.3 (Build 5350) or later to resolve the issue. As a temporary workaround, consider restricting access to the "technicianAction.do" endpoint for users with Add New Technician permissions until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-9163

Affected Products

Zoho Manageengine Recovery Manager Plus

References · 6

• 🔥 https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability · Exploit
• 🔥 https://exploit-db.com/exploits/44666 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-9163 · Security Note
• https://osv.dev/vulnerability/CVE-2018-9163 · Vendor Advisory
• https://manageengine.com/ad-recovery-manager/release-notes.html#5350 · Note
• http://securityfocus.com/bid/103773 · Note