CVE-2022-24681 : Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

Published 2022-04-07 22:15:08

Updated 2022-10-06 18:50:44

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2022-24681

Zohocorp » Manageengine Adselfservice Plus
Versions before (<) 6.1
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6100
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6103
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6101
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6102
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6104
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6105
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6106
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6113
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6107
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6108
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6109
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6110
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6111
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6112
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6114
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6114:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6115
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6115:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6116
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6116:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6117
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6117:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6118
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6118:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6119
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6119:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adselfservice Plus » Version: 6.1 Update 6120
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6120:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-24681

EPSS FAQ

0.44%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 74 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-24681

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2022-24681

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-24681

https://raxis.com/blog/cve-2022-24681

CVE-2022-24681 — Raxis
Exploit;Patch;Third Party Advisory
https://www.manageengine.com/products/self-service-password/kb/CVE-2022-24681.html

CVE-2022-24681: Security vulnerability issue—ManageEngine ADSelfService Plus
Patch;Vendor Advisory
https://manageengine.com

ManageEngine - IT Operations and Service Management Software
Product

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-24681

Products affected by CVE-2022-24681

Exploit prediction scoring system (EPSS) score for CVE-2022-24681

CVSS scores for CVE-2022-24681

CWE ids for CVE-2022-24681

References for CVE-2022-24681