CVE-2010-3274: XSS
First published: Thu Feb 17 2011(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a (1) showList or (2) Search action.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ADSelfService Plus | <=4.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/43241
- http://www.osvdb.org/70872
- http://www.osvdb.org/70871
- http://www.coresecurity.com/content/zoho-manageengine-vulnerabilities
- http://www.vupen.com/english/advisories/2011/0392
- http://www.securityfocus.com/bid/46331
- http://securityreason.com/securityalert/8089
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65349
- http://www.securityfocus.com/archive/1/516396/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2010-3274?
CVE-2010-3274 is classified as having a medium severity due to the potential for remote exploitation via cross-site scripting.
How do I fix CVE-2010-3274?
To fix CVE-2010-3274, upgrade ManageEngine ADSelfService Plus to version 4.5 Build 4500 or later.
What types of attacks are possible with CVE-2010-3274?
CVE-2010-3274 allows attackers to perform cross-site scripting attacks that can inject arbitrary web scripts or HTML into affected systems.
What parameters are vulnerable in CVE-2010-3274?
The vulnerable parameters in CVE-2010-3274 are 'searchString' used in the showList and Search actions.
Which versions of ManageEngine ADSelfService Plus are affected by CVE-2010-3274?
Versions of ManageEngine ADSelfService Plus prior to 4.5 Build 4500 are affected by CVE-2010-3274.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/zohocorp
- canonical/adselfservice plus
- version/adselfservice plus/4.4