CVE-2015-5150: XSS

Published Jun 30, 2015

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the (1) query parameter in the runqueryeditorquery module to CustomReportHandler.do, (2) compAcct parameter to jsp/ResetADPwd.jsp, or (3) redirectTo parameter to jsp/CacheScreenWidth.jsp.

Affected Software

1 affected component

ZohoCorp Manageengine Supportcenter Plus=7.90

Event History

Jun 30, 2015

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-5150?

CVE-2015-5150 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2015-5150?

To fix CVE-2015-5150, it is recommended to update to the latest version of Zoho ManageEngine SupportCenter Plus that addresses these vulnerabilities.

Who is affected by CVE-2015-5150?

CVE-2015-5150 affects users of Zoho ManageEngine SupportCenter Plus version 7.90.

What types of attacks can CVE-2015-5150 facilitate?

CVE-2015-5150 can facilitate cross-site scripting attacks, allowing attackers to inject arbitrary web scripts or HTML.

Are there any workarounds for CVE-2015-5150?

While there are no specific workarounds for CVE-2015-5150, restricting user input validation can help mitigate risks.