{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-05-24T16:48:36", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.manageengine.com/products/self-service-password/release-notes.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-8346", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.manageengine.com/products/self-service-password/release-notes.html", "refsource": "MISC", "url": "https://www.manageengine.com/products/self-service-password/release-notes.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T21:17:30.689Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.manageengine.com/products/self-service-password/release-notes.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-8346", "datePublished": "2019-05-24T16:48:36", "dateReserved": "2019-02-15T00:00:00", "dateUpdated": "2024-08-04T21:17:30.689Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5000:*:*:*:*:*:*", "matchCriteriaId": "9B826420-BD33-4C0F-A0C8-E614AFA0AE5F", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5001:*:*:*:*:*:*", "matchCriteriaId": "DAD07524-564F-4559-9F6D-EB8961380A5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5002:*:*:*:*:*:*", "matchCriteriaId": "76480E2A-FD99-4902-99D3-847136451618", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5010:*:*:*:*:*:*", "matchCriteriaId": "D117C2AE-B396-46AD-9421-23750F9D6CDE", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5011:*:*:*:*:*:*", "matchCriteriaId": "6B9F5FCF-BECA-424C-86C8-4769797AEB3B", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5020:*:*:*:*:*:*", "matchCriteriaId": "6A014DF4-0353-4117-927B-C7950D92EEF9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5021:*:*:*:*:*:*", "matchCriteriaId": "EC6163AF-1A41-4372-8D9B-985BB338B9F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5022:*:*:*:*:*:*", "matchCriteriaId": "2387D138-C8F5-4DC1-A51E-629F9D96F4ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5030:*:*:*:*:*:*", "matchCriteriaId": "0504B6B8-AFA0-418E-AA86-057F4FD01466", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5032:*:*:*:*:*:*", "matchCriteriaId": "78CA1BE6-6ACF-42B4-B603-9764A8B81555", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5040:*:*:*:*:*:*", "matchCriteriaId": "69866794-C599-49F7-8071-789DA3308AF0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.0:5041:*:*:*:*:*:*", "matchCriteriaId": "850DCAC9-D98E-40C1-A748-88E257F09388", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5100:*:*:*:*:*:*", "matchCriteriaId": "4523A4D2-1E40-4A14-81D7-820A2C81C90F", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5101:*:*:*:*:*:*", "matchCriteriaId": "F4C03D7C-0EEC-4C66-8705-F69909483048", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5102:*:*:*:*:*:*", "matchCriteriaId": "9431C11F-E153-4298-8A1B-2CDF677A1428", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5103:*:*:*:*:*:*", "matchCriteriaId": "557B4FD6-B1BD-47B4-87B8-7096B99695B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5104:*:*:*:*:*:*", "matchCriteriaId": "BE2EF829-DA42-4C87-AB14-B03BD0AFB177", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5105:*:*:*:*:*:*", "matchCriteriaId": "C74D8FDF-04B3-4B03-9110-27683E2329FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5106:*:*:*:*:*:*", "matchCriteriaId": "5C376A34-DC80-4080-9B53-37D954B6F00F", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5107:*:*:*:*:*:*", "matchCriteriaId": "4613CD78-8A7D-4382-9975-1BE698E6C2CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5108:*:*:*:*:*:*", "matchCriteriaId": "9F32937B-9B1D-495F-812A-BEBAF3C67540", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5109:*:*:*:*:*:*", "matchCriteriaId": "5683B22F-54D1-4C53-8378-3500ADB4AD2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5110:*:*:*:*:*:*", "matchCriteriaId": "08147E4E-6064-44D6-AF7C-1EB584A7CD60", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5111:*:*:*:*:*:*", "matchCriteriaId": "E0B110D0-A1BF-486B-A5C4-5927877C1258", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5112:*:*:*:*:*:*", "matchCriteriaId": "1C52392E-72C9-4F74-AECE-B20C0259E37D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5113:*:*:*:*:*:*", "matchCriteriaId": "38A4BE4A-B607-483E-AE79-8FF17BEF60B9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5114:*:*:*:*:*:*", "matchCriteriaId": "3B2ABFA6-4506-42F8-B458-9EB83C8312DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.1:5115:*:*:*:*:*:*", "matchCriteriaId": "B19B98B7-85D3-4D44-9853-1CD69586BF30", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.2:5200:*:*:*:*:*:*", "matchCriteriaId": "2EFDF89F-54BE-4D72-B95D-12127D8B35A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.2:5201:*:*:*:*:*:*", "matchCriteriaId": "E4DD32D9-A0CA-4434-A8CF-121942FDF152", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.2:5202:*:*:*:*:*:*", "matchCriteriaId": "F86FFDB3-B19E-438E-8E5C-6D4994A29B61", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.2:5203:*:*:*:*:*:*", "matchCriteriaId": "EB4C9B9E-2D26-4850-BAC4-7ABD3C8AE8BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.2:5204:*:*:*:*:*:*", "matchCriteriaId": "4921142A-2D9F-40BE-9640-44037667FB32", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.2:5205:*:*:*:*:*:*", "matchCriteriaId": "0909BEDE-D384-4719-87C7-4748E70669D5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.2:5206:*:*:*:*:*:*", "matchCriteriaId": "43969BCD-92A9-4181-9BE7-9A370FF0EA0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.2:5207:*:*:*:*:*:*", "matchCriteriaId": "B8C20F0D-43FD-4313-89DF-F2BCA271C1D5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5300:*:*:*:*:*:*", "matchCriteriaId": "190837F9-E545-4576-8660-76837BFBA127", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5301:*:*:*:*:*:*", "matchCriteriaId": "6C379810-C027-4443-BA2F-C72A0AFE9074", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5302:*:*:*:*:*:*", "matchCriteriaId": "BCF031DE-E118-4DF5-9699-6F14B7B3C6A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5303:*:*:*:*:*:*", "matchCriteriaId": "970C0BA4-6CA9-4304-BAC0-68B2403DCD9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5304:*:*:*:*:*:*", "matchCriteriaId": "6191E179-7D42-4D9A-AF78-B87DBC198B75", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5305:*:*:*:*:*:*", "matchCriteriaId": "01FC1A37-2AB7-4212-A93A-58021592FF67", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5306:*:*:*:*:*:*", "matchCriteriaId": "96287289-2736-4197-B325-9D58EFDD6A67", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5307:*:*:*:*:*:*", "matchCriteriaId": "3BCC8D28-C586-4E55-B7CD-A7116F5F65CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5308:*:*:*:*:*:*", "matchCriteriaId": "E2437FCD-F77F-4103-914C-20C54C3E088A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5309:*:*:*:*:*:*", "matchCriteriaId": "45F52278-27B0-431E-8FF0-E3A5F68D513D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5310:*:*:*:*:*:*", "matchCriteriaId": "E231C429-0C6D-4DA6-8D89-DB888493F741", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5311:*:*:*:*:*:*", "matchCriteriaId": "F7C72CCF-41A6-423D-AB08-DF6FA53E4F18", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5312:*:*:*:*:*:*", "matchCriteriaId": "999D1D05-D8D7-445E-AAF7-B14769001928", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5313:*:*:*:*:*:*", "matchCriteriaId": "CC29D099-13A7-48F5-8A8A-6A564B972D98", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5314:*:*:*:*:*:*", "matchCriteriaId": "AFAACD50-F964-48EB-8C71-856501FA5BF5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5315:*:*:*:*:*:*", "matchCriteriaId": "E52DD6D8-DCB5-470E-9F77-653552A5436B", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5316:*:*:*:*:*:*", "matchCriteriaId": "1E41D887-5E33-4D94-9C9C-7385D7D777E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5317:*:*:*:*:*:*", "matchCriteriaId": "352966E5-E938-4FA4-A41B-2D95C0E233ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5318:*:*:*:*:*:*", "matchCriteriaId": "2C234A10-9D5A-4C47-92F1-82DA80F5B310", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5319:*:*:*:*:*:*", "matchCriteriaId": "8E1516F7-D152-4D9C-92D3-4BD68D77475A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5320:*:*:*:*:*:*", "matchCriteriaId": "BDDFB075-FA1B-47B9-B2EC-80228C20F042", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5321:*:*:*:*:*:*", "matchCriteriaId": "9A55F076-4CED-4BFC-B87D-A2AE950F78CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5322:*:*:*:*:*:*", "matchCriteriaId": "50ACF821-D09A-40B9-95A6-BC8DED3460D2", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5323:*:*:*:*:*:*", "matchCriteriaId": "E0949C30-651A-4646-B215-38AE86F719F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5324:*:*:*:*:*:*", "matchCriteriaId": "2DA8E108-49A7-4281-A938-ED1C1E4890B9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5325:*:*:*:*:*:*", "matchCriteriaId": "3B631D21-372B-4B68-B467-F1A5616C5325", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5326:*:*:*:*:*:*", "matchCriteriaId": "26BC3F05-FC81-45E4-9D23-864C9B9FF47F", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5327:*:*:*:*:*:*", "matchCriteriaId": "1BBF87A7-2A53-418D-BB27-D55B10564894", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5328:*:*:*:*:*:*", "matchCriteriaId": "9343B338-953B-4E7D-9CD2-00781FFE3972", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5329:*:*:*:*:*:*", "matchCriteriaId": "9966E015-590E-4CAD-AEE9-F06E1B34A789", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.3:5330:*:*:*:*:*:*", "matchCriteriaId": "F3CD27A7-D7B8-4E7E-9F61-F5BCDC0DD007", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.4:5400:*:*:*:*:*:*", "matchCriteriaId": "04BB508C-91EA-43A3-B4AC-A7591801F387", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5500:*:*:*:*:*:*", "matchCriteriaId": "2B71FA9F-0FC4-4D12-B595-AC529878BC7E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5501:*:*:*:*:*:*", "matchCriteriaId": "E9B5A2E3-4F3D-48CC-A2F0-65B9AD2530F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5502:*:*:*:*:*:*", "matchCriteriaId": "0979E79B-936C-4787-8E0A-9F7F43A8A748", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5503:*:*:*:*:*:*", "matchCriteriaId": "673E69A8-71BA-49EC-B1AE-931736C6BF42", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5504:*:*:*:*:*:*", "matchCriteriaId": "141FB02E-695F-484E-8FF6-C334C11F7CCD", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5505:*:*:*:*:*:*", "matchCriteriaId": "C3CF5C1A-6C97-47BA-BF7E-977E3C938DA6", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5506:*:*:*:*:*:*", "matchCriteriaId": "79BEA328-C2CB-4CFA-8CF8-C8B70A37DF07", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5507:*:*:*:*:*:*", "matchCriteriaId": "942DC320-20A3-4CBF-BF94-390A9163FC02", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5508:*:*:*:*:*:*", "matchCriteriaId": "A42F5F45-4BF6-4076-AC36-F3EDDAC665A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5509:*:*:*:*:*:*", "matchCriteriaId": "600E4C41-B1E1-468D-BA1A-489D0CE5F565", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5510:*:*:*:*:*:*", "matchCriteriaId": "CE3BE5B8-37E1-4BB9-A59E-9F3F36BABDA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5511:*:*:*:*:*:*", "matchCriteriaId": "E41D8FA9-5D9D-4102-B117-40354F847403", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5512:*:*:*:*:*:*", "matchCriteriaId": "8E620B19-0286-4723-91C4-848B6C453509", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5513:*:*:*:*:*:*", "matchCriteriaId": "9274C66F-E6AA-4ABD-BF52-3BCCA75821EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5514:*:*:*:*:*:*", "matchCriteriaId": "C7D6AFFF-645C-42D0-ADC9-9D4852B0E5C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5515:*:*:*:*:*:*", "matchCriteriaId": "E7A0FC78-73CE-48CE-BD68-74C095F5B052", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5516:*:*:*:*:*:*", "matchCriteriaId": "74D85A59-40DE-4DF6-8F41-53BC9EF56DFC", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5517:*:*:*:*:*:*", "matchCriteriaId": "88B2C298-9BB4-4E2E-A1BF-6A4688248FCB", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5518:*:*:*:*:*:*", "matchCriteriaId": "0F5AB70E-BAD0-4C09-9328-89EF049E5C9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5519:*:*:*:*:*:*", "matchCriteriaId": "BF029B3F-93BE-44D3-B8E8-65F18A4F6632", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5520:*:*:*:*:*:*", "matchCriteriaId": "C054330B-8344-437B-893F-AD844BCA3CE0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5521:*:*:*:*:*:*", "matchCriteriaId": "CA7A820D-17C3-4F20-B4C4-9068F9594786", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.6:5600:*:*:*:*:*:*", "matchCriteriaId": "DEA0897C-62CE-401A-B940-4CA47A0BDF2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.6:5601:*:*:*:*:*:*", "matchCriteriaId": "63F66EA4-1DF6-4EE8-A42C-86D32B82F3BA", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.6:5602:*:*:*:*:*:*", "matchCriteriaId": "269B1711-8110-4177-8CF2-AD9F1D9E20AB", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.6:5603:*:*:*:*:*:*", "matchCriteriaId": "39DFD696-3A7F-4003-9F87-458891B787E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.6:5604:*:*:*:*:*:*", "matchCriteriaId": "C15E39AA-79CE-48A7-9629-AC75EC444B6C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.6:5605:*:*:*:*:*:*", "matchCriteriaId": "2592E246-7208-4CC5-8004-D2AEAB45380C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.6:5606:*:*:*:*:*:*", "matchCriteriaId": "967CA03D-EB7F-4FA7-8FDA-42EEBA2EF6E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.6:5607:*:*:*:*:*:*", "matchCriteriaId": "41EB109A-9CF3-498C-93B2-07A31D3CB09A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5702:*:*:*:*:*:*", "matchCriteriaId": "73FB7AA8-4BA9-49D4-A950-C33FA4C59CD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.7:5704:*:*:*:*:*:*", "matchCriteriaId": "59408AE1-F8C3-48A7-BF31-ABB4173E42D7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token."}, {"lang": "es", "value": "En Zoho ManageEngine ADSelfService Plus versi\u00f3n 5.x hasta 5704, una vulnerabilidad de tipo cross-site Scripting (XSS) en el archivo authorization.do permite una manipulaci\u00f3n no autenticada del c\u00f3digo JavaScript inyectando el formulario HTTP en el parametro adscsrf. Un atacante puede utilizar esto para capturar el restablecimiento de la contrase\u00f1a de autoservicio AD de un usuario y el token MFA."}], "id": "CVE-2019-8346", "lastModified": "2019-05-29T17:57:55.083", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-05-24T17:29:06.507", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.manageengine.com/products/self-service-password/release-notes.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}