CVE-2019-8346

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated…

published May 24, 2019

CVSS
—
EPSS
3%
Percentile
89.1
In the wild
Unconfirmed
What it is

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03496 · 89.1th percentile
Published
2019-05-24T16:48Z
EPSS history
Timeline
  • 24 MAY 16:48Z
    In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated…
    cvelistv5