CVE-2021-31813

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

22.8%

top 4.11%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Applications Manager

Timeline

PublishedJul 1

Latest updateMay 24

Description

Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages1 packages

▶NVDzohocorp/manageengine_applications_manager< 15.1+1

🔴Vulnerability Details

GHSA

GHSA-w44j-7c2c-9hf8: Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e↗2022-05-24

▶

CVEList

CVE-2021-31813: Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e↗2021-07-01

▶