CVE-2022-24681

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://manageengine.comProduct
https://raxis.com/blog/cve-2022-24681Exploit, Patch, Third Party Advisory
https://www.manageengine.com/products/self-service-password/kb/CVE-2022-24681.htmlPatch, Vendor Advisory
https://manageengine.comProduct
https://raxis.com/blog/cve-2022-24681Exploit, Patch, Third Party Advisory
https://www.manageengine.com/products/self-service-password/kb/CVE-2022-24681.htmlPatch, Vendor Advisory

Timeline

Published: Apr 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-246826.1An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the w CVE-2022-246837.5HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) cap CVE-2022-246846.5HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread CVE-2022-246857.5HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU CVE-2022-246865.9HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that CVE-2022-246876.5HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with CVE-2022-246888.8An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote CVE-2022-246895.3An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access accou CVE-2022-24698.1GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client CVE-2022-246908.2An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to t CVE-2022-246917.1An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database CVE-2022-246925.4An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page is vulnerable to sto