CVE-2018-9163

MOYENNE 5.4CVE-2018-9163 · Published 02/04/2018 · updated 17/06/2026

En bref

CVE-2018-9163 est une vulnérabilité MOYENNE (CVSS 5.4) touchant manageengine recovery manager plus (zohocorp).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 4.8%, plus élevée que 92.0% des vulnérabilités.
Correctif : mettre à jour vers 5.3 ou plus récent.

Package	Affected versions	Patched versions
manageengine recovery manager plus zohocorp	`< 5.3`	`5.3`

Description

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.

References

securityfocus.com/bid/103773 · Third Party Advisory
gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability · Exploit
exploit-db.com/exploits/44666 · Third Party Advisory
manageengine.com/ad-recovery-manager/release-notes.html · Release Notes

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free