Cross-Site Scripting Vulnerability in Zoho ManageEngine ADAudit Plus
CVE-2023-37308

5.4MEDIUM

Key Information:

Vendor

Zohocorp
Status
Manageengine Adaudit Plus
Vendor
CVE Published:
7 July 2023

What is CVE-2023-37308?

A vulnerability exists in Zoho ManageEngine ADAudit Plus that allows an attacker to exploit the application via cross-site scripting (XSS) through the input field for usernames. This could potentially allow unauthorized code execution in the user's browser, facilitating session hijacking or other malicious activities. The issue affects versions prior to 7100, emphasizing the importance of updating to the latest version to safeguard sensitive information.

References

https://www.manageengine.com/products/active-directory-au...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.