CVE-2021-28382

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Key Manager Plus versions prior to 6001

Description: The issue allows Stored XSS on the user-management page while importing malicious user details from AD. This occurs when malicious user details are imported, potentially leading to stored cross-site scripting attacks.

Recommendations: For versions prior to 6001, update to version 6001 or later to resolve the issue. As a temporary workaround, consider restricting the import of user details from AD to minimize the risk of exploitation. Avoid using the user-management page for importing user details until the issue is resolved.