PT-2023-11760 · Zoho · Manageengine Password Manager Pro

Published 2023-08-11 · Updated 2023-08-16 · CVE-2020-27449

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Password Manager Pro version 11001

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the Query Report feature, which allows remote attackers to execute arbitrary code and steal cookies via a crafted JavaScript payload.

Recommendations For Zoho ManageEngine Password Manager Pro version 11001, consider disabling the Query Report feature until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the Query Report feature to minimize the risk of arbitrary code execution and cookie theft. Avoid using the Query Report feature with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-27449

Affected Products

Manageengine Password Manager Pro

References · 6

• https://bugbounty.zoho.com/bb/#/bug/101000003619211 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27449 · Security Note
• https://t.me/cvenotify/56271 · Telegram Post
• https://twitter.com/CVEnew/status/1690264158250385408 · Twitter Post
• https://manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002 · Note