PT-2023-7071 · Zoho · Zoho Manageengine Applications Manager

Published 2023-08-10 · Updated 2025-03-07 · CVE-2023-38333

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions through 16530

Description The issue is related to the failure to protect the web page structure, allowing a remote attacker to conduct a cross-site scripting attack and execute arbitrary code. This can be achieved through reflected XSS while logged in. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions through 16530, update to a version that includes the fix for this issue to prevent reflected XSS attacks. As a temporary workaround, consider restricting access to sensitive features or pages that may be vulnerable to cross-site scripting attacks until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08096

CVE-2023-38333

ZDI-23-1715

Affected Products

Zoho Manageengine Applications Manager

References · 10

• https://osv.dev/vulnerability/CVE-2023-38333 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08096 · Security Note
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-38333.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38333 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1715 · Security Note
• https://t.me/cibsecurity/68249 · Telegram Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-21226 · Note
• https://twitter.com/VulmonFeeds/status/1689766880154673152 · Twitter Post
• https://t.me/cvenotify/113899 · Telegram Post
• https://vuldb.com/es/?id.236917 · Note