Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-24681: Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

CVE-2022-24681 · published 4 years ago

Summary

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

What to do

Update zohocorp manageengine_adselfservice_plus to version 6.1 or later.

Affected software

Vendor	Product	Affected versions
zohocorp	manageengine_adselfservice_plus	< 6.1 6.1 `cpe:2.3:a:zohocorp:manageengine_adselfservice_plus::::::::`

Original advisory text

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

References

https://manageengine.com Product
https://raxis.com/blog/cve-2022-24681 Exploit Patch Third Party Advisory
https://www.manageengine.com/products/self-service-password/kb/CVE-2022-24681.ht... Patch Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

4% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published7 Apr 2022

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-24681 · NVD

Track software like this

Free during beta