PT-2022-16796 · Zoho · Zoho Manageengine Adselfservice Plus

Matt · Published 2022-04-07 · Updated 2022-10-06 · CVE-2022-24681

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 6121

Description The issue allows for XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen. This can be exploited by manipulating the welcome name attribute.

Recommendations For versions prior to 6121, update to version 6121 or later to resolve the issue. As a temporary workaround, consider restricting access to the Reset Password, Unlock Account, or User Must Change Password screens until the update is applied. Avoid using the welcome name attribute in these screens until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24681

Affected Products

Zoho Manageengine Adselfservice Plus

References · 9

• 🔥 https://raxis.com/blog/cve-2022-24681 · Exploit
• https://manageengine.com/products/self-service-password/kb/CVE-2022-24681.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24681 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24681 · Vendor Advisory
• https://t.me/cvenotify/28626 · Telegram Post
• https://t.me/cvenotify/28642 · Telegram Post
• https://t.me/cibsecurity/40332 · Telegram Post
• https://manageengine.com · Note
• https://t.me/cvenotify/28851 · Telegram Post