Reflected XSS Vulnerability in Zoho ManageEngine SupportCenter Plus Accounts Module
CVE-2021-43295

6.1MEDIUM

Key Information:

Vendor

Zohocorp
Status
Manageengine Supportcenter Plus
Vendor
CVE Published:
30 November 2021

What is CVE-2021-43295?

A reflected XSS vulnerability exists in the Accounts module of Zoho ManageEngine SupportCenter Plus prior to version 11016. This flaw allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user data and web application integrity. The vulnerability is a vector for delivering attacks that could lead to unauthorized access or data leakage, necessitating immediate attention from users and administrators.

References

https://manageengine.com
x_refsource_MISC
https://www.manageengine.com/products/support-center/read...
x_refsource_MISC

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.