CVE-2010-3274: XSS
Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a (1) showList or (2) Search action.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3274?
CVE-2010-3274 is classified as having a medium severity due to the potential for remote exploitation via cross-site scripting.
How do I fix CVE-2010-3274?
To fix CVE-2010-3274, upgrade ManageEngine ADSelfService Plus to version 4.5 Build 4500 or later.
What types of attacks are possible with CVE-2010-3274?
CVE-2010-3274 allows attackers to perform cross-site scripting attacks that can inject arbitrary web scripts or HTML into affected systems.
What parameters are vulnerable in CVE-2010-3274?
The vulnerable parameters in CVE-2010-3274 are 'searchString' used in the showList and Search actions.
Which versions of ManageEngine ADSelfService Plus are affected by CVE-2010-3274?
Versions of ManageEngine ADSelfService Plus prior to 4.5 Build 4500 are affected by CVE-2010-3274.