CVE-2022-24681 Scanner
Detects 'Cross-Site Scripting (XSS)' vulnerability in Zoho ManageEngine ADSelfService Plus affects v. before 6121.
Short Info
Level
Medium
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
29 days
Scan only one
Domain, IPv4
Toolbox
-
Zoho ManageEngine ADSelfService Plus is a comprehensive self-service password management and single sign-on solution used by businesses and organizations to improve security and productivity. This software facilitates end-users to reset passwords, unlock accounts, and change passwords on their own, without relying on IT support. Plus, it offers multifactor authentication support to add an extra layer of security to the access management process. ADSelfService Plus is widely recognized for its efficiency, ease of use, and extensive range of secure configurations.
The vulnerability code CVE-2022-24681 was detected in Zoho ManageEngine ADSelfService Plus before 6121 versions. This security flaw allowed cross-site scripting (XSS) through the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen. This XSS attack could be executed when a hacker creates a malicious link that when clicked would inject harmful code into the web page, leading to unauthorized access to sensitive data and confidential information.
If left unaddressed, this vulnerability could lead to severe repercussions for a business. For instance, an attacker could gain access to administrative credentials or steal sensitive data, leading to reputational damage, financial loss, and legal consequences. Furthermore, a successful XSS attack could also spread malware across the organization's network, potentially compromising all connected devices and systems.
s4e.io provides access to an extensive knowledgebase on data security and privacy threats and vulnerabilities, including those affecting Zoho ManageEngine ADSelfService Plus. This website's pro features allow users to receive real-time notifications of security vulnerabilities, as well as implementing a proactive monitoring approach. With s4e.io, organizations can stay ahead of the curve in terms of cyber threats, safeguarding their digital assets, and preserving business continuity.
REFERENCES