CVE-2022-24681

Severity Score

6.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

Zoho ManageEngine ADSelfService Plus versiones anteriores a 6121, permite un ataque de tipo XSS por medio del atributo welcome name en la pantalla Reset Password, Unlock Account, o User Must Change Password

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-02-09 CVE Reserved
2022-04-07 CVE Published
2024-08-03 CVE Updated
2024-08-03 First Exploit
2024-11-11 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (3)

URL	Tag	Source
https://manageengine.com	Product

URL	Date	SRC
https://raxis.com/blog/cve-2022-24681	2024-08-03

URL	Date	SRC
https://www.manageengine.com/products/self-service-password/kb/CVE-2022-24681.html	2022-10-06

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				< 6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version " < 6.1"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6100		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6101		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6102		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6103		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6104		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6105		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6106		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6107		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6108		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6109		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6110		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6111		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6112		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6113		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6114		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6115		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6116		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6117		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6118		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6119		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				6.1 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"		6120		Affected