CVE-2021-46065

Опубликовано: 27 янв. 2022

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Средний

Описание

A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.

Ссылки

https://github.com/corrupted-brain/Findings/blob/main/ManageEngine%20XSS.md
Exploit
Third Party Advisory
https://www.manageengine.com/products/service-desk/on-premises/readme.html
Release Notes
Third Party Advisory
https://github.com/corrupted-brain/Findings/blob/main/ManageEngine%20XSS.md
Exploit
Third Party Advisory
https://www.manageengine.com/products/service-desk/on-premises/readme.html
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11306:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.20355

Средний

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-xph7-8872-8h48

github

около 4 лет назад