CVE-2023-38333
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
Zoho ManageEngine Applications Manager through version 16530 allows reflected XSS while logged in.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious scripts in the user's browser context, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to upgrade to the latest version of Zoho ManageEngine Applications Manager to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Zoho ManageEngine Applications Manager
See all- CVE-2017-16542High
Zoho ManageEngine Applications Manager version 13 before build 13500 allows post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request.
- CVE-2017-16851Critical
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the widgetid parameter in /MyPage.do.
- CVE-2017-16850Critical
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the resourceid parameter in the getResourceProfiles action.
- CVE-2017-16849Critical
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the forpage parameter in the /MyPage.do?method=viewDashBoard request.
- CVE-2017-16848Critical
Zoho ManageEngine Applications Manager 13 is vulnerable to SQL injection via the groupname parameter in /manageConfMons.do.
- CVE-2017-16847Critical
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the resourceid parameter in a showPlasmaView action.
- CVE-2017-16846Critical
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the haid parameter in the /manageApplications.do?method=AddSubGroup request.
- CVE-2017-16543Critical
Zoho ManageEngine Applications Manager version 13 before build 13500 is vulnerable to SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.
Original NVD description (English source)
Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in.