Detections
Analytics
CVE-2017-11686
medium
Description
Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allows remote attackers to obtain an authenticated user's password via XSS vulnerabilities or sniffing non-SSL traffic on the network, because the password is represented in a cookie with a reversible encoding method.
References
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3296
http://init6.me/exploiting-manageengine-eventlog-analyzer.html