CVE-2018-9163

Опубликовано: 02 апр. 2018

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.

Ссылки

http://www.securityfocus.com/bid/103773
Third Party Advisory
VDB Entry
https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/44666/
Third Party Advisory
VDB Entry
https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350
Release Notes
http://www.securityfocus.com/bid/103773
Third Party Advisory
VDB Entry
https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/44666/
Third Party Advisory
VDB Entry
https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350
Release Notes

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zohocorp:manageengine_recovery_manager_plus:*:*:*:*:*:*:*:*

Версия до 5.3 (исключая)

EPSS

Процентиль: 85%

0.02437

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-vq83-9rx8-rq3m