VulnerabilityModified
CVE-2014-3779
Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do.
MEDIUM 4.3EPSS 3.54%
Does this matter?
Lower severity and a low EPSS score (3.54%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 3.54% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- zohocorp/manageengine adselfservice plus
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/129803/ADSelfservice-Plus-5.1-Cross-Site-Scripting.htmlExploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99612
- http://packetstormsecurity.com/files/129803/ADSelfservice-Plus-5.1-Cross-Site-Scripting.htmlExploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99612
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.