ManageEngine ADSelfService Plus < 5.3 Build 5313 PasswordSelfServiceAPI XSS

medium Nessus Plugin ID 91989

Language:

Synopsis

A web application running on the remote host is affected by a cross-site scripting vulnerability.

Description

The ManageEngine ADSelfService Plus application running on the remote host is affected by a cross-site scripting (XSS) vulnerability in PasswordSelfServiceAPI due to improper sanitization of user-supplied input to the 'PSS_OPERATION' parameter. An unauthenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary scripting code in the user's browser session. An attacker can also exploit this issue to disclose cookie-based authentication credentials.

Solution

Upgrade to ManageEngine ADSelfService Plus version 5.3 build 5313 or later.

Plugin Details

Severity: Medium

ID: 91989

File Name: manageengine_adselfservice_pssapi_xss.nasl

Version: 1.7

Type: remote

Family: CGI abuses : XSS

Published: 7/11/2016

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

Vulnerability Information

CPE: cpe:/a:zohocorp:manageengine_adselfservice_plus

Required KB Items: installed_sw/ManageEngine ADSelfService Plus

Patch Publication Date: 5/27/2016

Vulnerability Publication Date: 5/29/2016

Detections

Analytics