PT-2021-17857
CVE-2021-28382
·
تاريخ النشر
2021-06-07
·
تاريخ التحديث
2021-06-14
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
Zoho ManageEngine Key Manager Plus versions prior to 6001
Description:
The issue allows Stored XSS on the user-management page while importing malicious user details from AD. This occurs when malicious user details are imported, potentially leading to stored cross-site scripting attacks.
Recommendations:
For versions prior to 6001, update to version 6001 or later to resolve the issue. As a temporary workaround, consider restricting the import of user details from AD to minimize the risk of exploitation. Avoid using the user-management page for importing user details until the issue is resolved.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾