| Package | Affected versions | Patched versions |
|---|---|---|
| manageengine adselfservice plus | = 5.0= 5.1= 5.2= 5.3= 5.4= 5.5= 5.6= 5.7 |
In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free