PT-2018-18900
CVE-2018-9163
·
تاريخ النشر
2018-04-02
·
تاريخ التحديث
2019-02-27
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Zoho ManageEngine Recovery Manager Plus versions prior to 5.3 (Build 5350)
Description
A stored Cross-site scripting (XSS) issue allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the
loginName field to the "technicianAction.do" endpoint.Recommendations
For versions prior to 5.3 (Build 5350), update to version 5.3 (Build 5350) or later to resolve the issue. As a temporary workaround, consider restricting access to the "technicianAction.do" endpoint for users with Add New Technician permissions until the update is applied.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾