Stored XSS Vulnerability in Zoho ManageEngine ADSelfService Plus

CVE-2021-27956

What is CVE-2021-27956?

Zoho ManageEngine ADSelfService Plus prior to version 6104 is susceptible to a stored XSS vulnerability when users interact with the search feature on the directory search page. This issue arises through the email address field, where an attacker can inject malicious scripts that may be executed in the context of an unsuspecting user. As a result, unauthorized actions and data exposure can occur, impacting the overall integrity and security of the application.

References