CVE-2018-20485: XSS
Published Dec 26, 2018
·Updated
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
Affected Software
116 affected components
ZohoCorp ManageEngine ADSelfService Plus=4.5-4510
ZohoCorp ManageEngine ADSelfService Plus=4.5-4511
ZohoCorp ManageEngine ADSelfService Plus=4.5-4520
ZohoCorp ManageEngine ADSelfService Plus=4.5-4522
ZohoCorp ManageEngine ADSelfService Plus=4.5-4531
ZohoCorp ManageEngine ADSelfService Plus=4.5-4540
ZohoCorp ManageEngine ADSelfService Plus=4.5-4543
ZohoCorp ManageEngine ADSelfService Plus=4.5-4544
ZohoCorp ManageEngine ADSelfService Plus=4.5-4550
ZohoCorp ManageEngine ADSelfService Plus=4.5-4560
ZohoCorp ManageEngine ADSelfService Plus=4.5-4570
ZohoCorp ManageEngine ADSelfService Plus=4.5-4571
ZohoCorp ManageEngine ADSelfService Plus=4.5-4572
ZohoCorp ManageEngine ADSelfService Plus=4.5-4580
ZohoCorp ManageEngine ADSelfService Plus=4.5-4590
ZohoCorp ManageEngine ADSelfService Plus=4.5-4591
ZohoCorp ManageEngine ADSelfService Plus=4.5-4592
ZohoCorp ManageEngine ADSelfService Plus=5.0-5000
ZohoCorp ManageEngine ADSelfService Plus=5.0-5001
ZohoCorp ManageEngine ADSelfService Plus=5.0-5002
ZohoCorp ManageEngine ADSelfService Plus=5.0-5010
ZohoCorp ManageEngine ADSelfService Plus=5.0-5011
ZohoCorp ManageEngine ADSelfService Plus=5.0-5020
ZohoCorp ManageEngine ADSelfService Plus=5.0-5021
ZohoCorp ManageEngine ADSelfService Plus=5.0-5022
ZohoCorp ManageEngine ADSelfService Plus=5.0-5030
ZohoCorp ManageEngine ADSelfService Plus=5.0-5032
ZohoCorp ManageEngine ADSelfService Plus=5.0-5040
ZohoCorp ManageEngine ADSelfService Plus=5.0-5041
ZohoCorp ManageEngine ADSelfService Plus=5.1-5100
ZohoCorp ManageEngine ADSelfService Plus=5.1-5101
ZohoCorp ManageEngine ADSelfService Plus=5.1-5102
ZohoCorp ManageEngine ADSelfService Plus=5.1-5103
ZohoCorp ManageEngine ADSelfService Plus=5.1-5104
ZohoCorp ManageEngine ADSelfService Plus=5.1-5105
ZohoCorp ManageEngine ADSelfService Plus=5.1-5106
ZohoCorp ManageEngine ADSelfService Plus=5.1-5107
ZohoCorp ManageEngine ADSelfService Plus=5.1-5108
ZohoCorp ManageEngine ADSelfService Plus=5.1-5109
ZohoCorp ManageEngine ADSelfService Plus=5.1-5110
ZohoCorp ManageEngine ADSelfService Plus=5.1-5111
ZohoCorp ManageEngine ADSelfService Plus=5.1-5112
ZohoCorp ManageEngine ADSelfService Plus=5.1-5113
ZohoCorp ManageEngine ADSelfService Plus=5.1-5114
ZohoCorp ManageEngine ADSelfService Plus=5.1-5115
ZohoCorp ManageEngine ADSelfService Plus=5.2-5200
ZohoCorp ManageEngine ADSelfService Plus=5.2-5201
ZohoCorp ManageEngine ADSelfService Plus=5.2-5202
ZohoCorp ManageEngine ADSelfService Plus=5.2-5203
ZohoCorp ManageEngine ADSelfService Plus=5.2-5204
ZohoCorp ManageEngine ADSelfService Plus=5.2-5205
ZohoCorp ManageEngine ADSelfService Plus=5.2-5206
ZohoCorp ManageEngine ADSelfService Plus=5.2-5207
ZohoCorp ManageEngine ADSelfService Plus=5.3-5300
ZohoCorp ManageEngine ADSelfService Plus=5.3-5301
ZohoCorp ManageEngine ADSelfService Plus=5.3-5302
ZohoCorp ManageEngine ADSelfService Plus=5.3-5303
ZohoCorp ManageEngine ADSelfService Plus=5.3-5304
ZohoCorp ManageEngine ADSelfService Plus=5.3-5305
ZohoCorp ManageEngine ADSelfService Plus=5.3-5306
ZohoCorp ManageEngine ADSelfService Plus=5.3-5307
ZohoCorp ManageEngine ADSelfService Plus=5.3-5308
ZohoCorp ManageEngine ADSelfService Plus=5.3-5309
ZohoCorp ManageEngine ADSelfService Plus=5.3-5310
ZohoCorp ManageEngine ADSelfService Plus=5.3-5311
ZohoCorp ManageEngine ADSelfService Plus=5.3-5312
ZohoCorp ManageEngine ADSelfService Plus=5.3-5313
ZohoCorp ManageEngine ADSelfService Plus=5.3-5314
ZohoCorp ManageEngine ADSelfService Plus=5.3-5315
ZohoCorp ManageEngine ADSelfService Plus=5.3-5316
ZohoCorp ManageEngine ADSelfService Plus=5.3-5317
ZohoCorp ManageEngine ADSelfService Plus=5.3-5318
ZohoCorp ManageEngine ADSelfService Plus=5.3-5319
ZohoCorp ManageEngine ADSelfService Plus=5.3-5320
ZohoCorp ManageEngine ADSelfService Plus=5.3-5321
ZohoCorp ManageEngine ADSelfService Plus=5.3-5322
ZohoCorp ManageEngine ADSelfService Plus=5.3-5323
ZohoCorp ManageEngine ADSelfService Plus=5.3-5324
ZohoCorp ManageEngine ADSelfService Plus=5.3-5325
ZohoCorp ManageEngine ADSelfService Plus=5.3-5326
ZohoCorp ManageEngine ADSelfService Plus=5.3-5327
ZohoCorp ManageEngine ADSelfService Plus=5.3-5328
ZohoCorp ManageEngine ADSelfService Plus=5.3-5329
ZohoCorp ManageEngine ADSelfService Plus=5.3-5330
ZohoCorp ManageEngine ADSelfService Plus=5.4-5400
ZohoCorp ManageEngine ADSelfService Plus=5.5-5500
ZohoCorp ManageEngine ADSelfService Plus=5.5-5501
ZohoCorp ManageEngine ADSelfService Plus=5.5-5502
ZohoCorp ManageEngine ADSelfService Plus=5.5-5503
ZohoCorp ManageEngine ADSelfService Plus=5.5-5504
ZohoCorp ManageEngine ADSelfService Plus=5.5-5505
ZohoCorp ManageEngine ADSelfService Plus=5.5-5506
ZohoCorp ManageEngine ADSelfService Plus=5.5-5507
ZohoCorp ManageEngine ADSelfService Plus=5.5-5508
ZohoCorp ManageEngine ADSelfService Plus=5.5-5509
ZohoCorp ManageEngine ADSelfService Plus=5.5-5510
ZohoCorp ManageEngine ADSelfService Plus=5.5-5511
ZohoCorp ManageEngine ADSelfService Plus=5.5-5512
ZohoCorp ManageEngine ADSelfService Plus=5.5-5513
ZohoCorp ManageEngine ADSelfService Plus=5.5-5514
ZohoCorp ManageEngine ADSelfService Plus=5.5-5515
ZohoCorp ManageEngine ADSelfService Plus=5.5-5516
ZohoCorp ManageEngine ADSelfService Plus=5.5-5517
ZohoCorp ManageEngine ADSelfService Plus=5.5-5518
ZohoCorp ManageEngine ADSelfService Plus=5.5-5519
ZohoCorp ManageEngine ADSelfService Plus=5.5-5520
ZohoCorp ManageEngine ADSelfService Plus=5.5-5521
ZohoCorp ManageEngine ADSelfService Plus=5.6-5600
ZohoCorp ManageEngine ADSelfService Plus=5.6-5601
ZohoCorp ManageEngine ADSelfService Plus=5.6-5602
ZohoCorp ManageEngine ADSelfService Plus=5.6-5603
ZohoCorp ManageEngine ADSelfService Plus=5.6-5604
ZohoCorp ManageEngine ADSelfService Plus=5.6-5605
ZohoCorp ManageEngine ADSelfService Plus=5.6-5606
ZohoCorp ManageEngine ADSelfService Plus=5.6-5607
ZohoCorp ManageEngine ADSelfService Plus=5.7-5702
Event History
Dec 26, 2018
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-20485?
CVE-2018-20485 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2018-20485?
To fix CVE-2018-20485, upgrade to ManageEngine ADSelfService Plus version 5.7 build 5702 or later.
3
What type of vulnerability is CVE-2018-20485?
CVE-2018-20485 is a cross-site scripting (XSS) vulnerability affecting the employee search feature.
4
What impact does CVE-2018-20485 have on users?
An attacker could exploit CVE-2018-20485 to execute arbitrary scripts in the context of a user's session.
5
Which versions of ManageEngine ADSelfService Plus are affected by CVE-2018-20485?
CVE-2018-20485 affects versions of ManageEngine ADSelfService Plus prior to 5.7 build 5702.