PT-2019-18979 · Zoho · Zoho Manageengine Adselfservice Plus

Published 2019-05-24 · Updated 2019-05-29 · CVE-2019-8346

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 5.x through 5704

Description The issue allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf in the authorization.do endpoint. This can be used to capture a user's AD self-service password reset and MFA token.

Recommendations For versions 5.x through 5704, consider restricting access to the authorization.do endpoint until a patch is available. As a temporary workaround, avoid using the adscsrf parameter in the affected endpoint to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-8346

Affected Products

Zoho Manageengine Adselfservice Plus

References · 3

• https://manageengine.com/products/self-service-password/release-notes.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8346 · Security Note
• https://osv.dev/vulnerability/CVE-2019-8346 · Vendor Advisory