CVE-2022-24681
Published: 07 April 2022
Summary
CVE-2022-24681 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Zohocorp Manageengine Adselfservice Plus. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 4.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Zoho ManageEngine ADSelfService Plus versions prior to 6121 contain a cross-site scripting vulnerability tracked as CVE-2022-24681. The flaw resides in the handling of the welcome name attribute on the Reset Password, Unlock Account, and User Must Change Password screens, allowing attacker-supplied input to be reflected into HTML without adequate sanitization. The issue is classified under CWE-79 and carries a CVSS 3.1 score of 6.1.
An unauthenticated remote attacker can supply a crafted welcome name that executes script in the browser of any user who visits the affected screens. Because the attack requires user interaction and results in changed scope, successful exploitation can expose limited session data or enable actions within the victim's application context.
ManageEngine advisories state that the vulnerability is resolved in ADSelfService Plus 6121 and later releases, directing administrators to apply the update through the vendor's standard patch channels. The associated EPSS score has reached a peak of 0.2341 with a current value of 0.2140.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29553
Vulnerability details
Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.