CVE-2018-17596

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine AssetExplorer version 6.2.0

Description A Stored XSS issue was found in Zoho ManageEngine AssetExplorer. The vulnerability can be exploited via the "ciName" or "assetName" parameter in the "/AssetDef.do" API endpoint.

Recommendations For Zoho ManageEngine AssetExplorer version 6.2.0, consider disabling access to the "/AssetDef.do" API endpoint until a patch is available. As a temporary workaround, restrict the use of the ciName and assetName parameters in this endpoint to minimize the risk of exploitation.