VulnerabilityModified

CVE-2018-9163

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field…

MEDIUM 5.4EPSS 4.80%

Does this matter?

Lower severity and a low EPSS score (4.80%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 4.80% probability · 91th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: zohocorp/manageengine recovery manager plus
Source: cve@mitre.org

References

http://www.securityfocus.com/bid/103773Third Party Advisory, VDB Entry
https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44666/Third Party Advisory, VDB Entry
https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350Release Notes
http://www.securityfocus.com/bid/103773Third Party Advisory, VDB Entry
https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44666/Third Party Advisory, VDB Entry
https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350Release Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.