CVE-2020-27449

EUVD-2020-19959
Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
Affected Products (NVD)
VendorProductVersion
zohocorpmanageengine_password_manager_pro
11.1:build_11101
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://bugbounty.zoho.com/bb/#/bug/101000003619211
https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002
https://bugbounty.zoho.com/bb/#/bug/101000003619211
https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002