PT-2023-21664 · Zoho · Zoho Manageengine Applications Manager

Rahul Maini · Published 2023-04-11 · Updated 2023-04-14 · CVE-2023-28341

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions through 16340

Description A stored Cross site scripting (XSS) issue allows an unauthenticated user to inject malicious javascript on the incorrect login details page. This can be exploited by injecting malicious code into the login page, potentially affecting user sessions.

Recommendations For versions through 16340, update to a version that includes a fix for this issue to prevent malicious javascript injection. As a temporary workaround, consider restricting access to the login page to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28341

Affected Products

Zoho Manageengine Applications Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-28341 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28341 · Vendor Advisory
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-28341.html · Vendor Advisory
• https://t.me/cibsecurity/61834 · Telegram Post
• https://t.me/cvenotify/47978 · Telegram Post
• https://manageengine.com · Note