medium6.1Public exploit code
CVE-2018-20485
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Cross-Site Scripting2019-05-09 · webapps · php
Impact
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Adselfservice Plus | Versions 4.5, 5.0, 5.1, 5.2, 5.3, 5.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/152793/Zoho-ManageEngine-ADSelfService-Plus-5.7-Cross-Site-Scripting.html
- https://www.manageengine.com/products/self-service-password/release-notes.html
- http://packetstormsecurity.com/files/152793/Zoho-ManageEngine-ADSelfService-Plus-5.7-Cross-Site-Scripting.html
- https://www.manageengine.com/products/self-service-password/release-notes.html