PT-2021-17857 · Zoho · Zoho Manageengine Admanager Plus

Matt Dunn · Published 2021-06-07 · Updated 2021-06-14 · CVE-2021-28382

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Key Manager Plus versions prior to 6001

Description: The issue allows Stored XSS on the user-management page while importing malicious user details from AD. This occurs when malicious user details are imported, potentially leading to stored cross-site scripting attacks.

Recommendations: For versions prior to 6001, update to version 6001 or later to resolve the issue. As a temporary workaround, consider restricting the import of user details from AD to minimize the risk of exploitation. Avoid using the user-management page for importing user details until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-28382

Affected Products

Zoho Manageengine Admanager Plus

References · 5

• 🔥 https://raxis.com/blog/cve-2021-28382 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-28382 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28382 · Vendor Advisory
• https://manageengine.com/key-manager/release-notes.html#6001 · Vendor Advisory
• https://t.me/cvenotify/15683 · Telegram Post