CVE-2021-40178: XSS
Published Aug 29, 2021
·Updated
Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGOPATH key value in the logon settings.
Affected Software
12 affected components
Zohocorp ManageEngine Log360<=5.1
Zohocorp ManageEngine Log360=5.2-build5200
Zohocorp ManageEngine Log360=5.2-build5201
Zohocorp ManageEngine Log360=5.2-build5206
Zohocorp ManageEngine Log360=5.2-build5209
Zohocorp ManageEngine Log360=5.2-build5210
Zohocorp ManageEngine Log360=5.2-build5211
Zohocorp ManageEngine Log360=5.2-build5213
Zohocorp ManageEngine Log360=5.2-build5214
Zohocorp ManageEngine Log360=5.2-build5218
Zohocorp ManageEngine Log360=5.2-build5219
Zohocorp ManageEngine Log360=5.2-build5220_beta
Event History
Aug 29, 2021
CVE Published
via MITRE·07:17 PM
Data Sourced
via MITRE·07:17 PM
Description
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2021-40178?
CVE-2021-40178 is a vulnerability in Zoho ManageEngine Log360 that allows stored XSS via the LOGO_PATH key value in the logon settings.
2
What is the severity of CVE-2021-40178?
The severity of CVE-2021-40178 is medium with a CVSS score of 6.1.
3
How does CVE-2021-40178 affect Zoho ManageEngine Log360?
CVE-2021-40178 affects Zoho ManageEngine Log360 versions 5.1 and 5.2-build5200 to 5.2-build5220_beta.
4
How can I fix CVE-2021-40178?
To fix CVE-2021-40178, update Zoho ManageEngine Log360 to Build 5224 or later.
5
Where can I find more information about CVE-2021-40178?
You can find more information about CVE-2021-40178 in the Zoho ManageEngine Log360 release notes at https://www.manageengine.com/log-management/readme.html#Build%205224.