CVE-2018-9163

中危 5.4CVE-2018-9163 · Published 02/04/2018 · updated 17/06/2026

要点

CVE-2018-9163 是影响 manageengine recovery manager plus (zohocorp) 的中危 (CVSS 5.4)漏洞。
未来 30 天内被利用的概率（EPSS）：4.8%，高于 92.0% 的漏洞。
修复：升级到 5.3 或更高版本。

Package	Affected versions	Patched versions
manageengine recovery manager plus zohocorp	`< 5.3`	`5.3`

Description

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.

References

securityfocus.com/bid/103773 · Third Party Advisory
gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability · Exploit
exploit-db.com/exploits/44666 · Third Party Advisory
manageengine.com/ad-recovery-manager/release-notes.html · Release Notes

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free