Read the docs
TI-2022-08499 Aliases CVE-2022-24681GHSA-gqq3-rphm-wjhv

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name…

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

Why it matters now

EPSS 0.03619 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*before 6.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:*6.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:*6.1 6100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:*6.1 6101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:*6.1 6102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:*6.1 6103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:*6.1 6104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:*6.1 6105VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:*6.1 6106VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:*6.1 6107VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* Versions before 6.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:* Versions 6.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:* Versions 6.1 6100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:* Versions 6.1 6101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:* Versions 6.1 6102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:* Versions 6.1 6103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:* Versions 6.1 6104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:* Versions 6.1 6105 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:* Versions 6.1 6106 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:* Versions 6.1 6107 Vulnerable ·Zohocorp
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:*6.1 6108VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:*6.1 6109VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:*6.1 6110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:*6.1 6111VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:*6.1 6112VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:*6.1 6113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6114:*:*:*:*:*:*6.1 6114VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6115:*:*:*:*:*:*6.1 6115VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6116:*:*:*:*:*:*6.1 6116VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6117:*:*:*:*:*:*6.1 6117VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6118:*:*:*:*:*:*6.1 6118VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6119:*:*:*:*:*:*6.1 6119VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6120:*:*:*:*:*:*6.1 6120VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:* Versions 6.1 6108 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:* Versions 6.1 6109 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:* Versions 6.1 6110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:* Versions 6.1 6111 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:* Versions 6.1 6112 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:* Versions 6.1 6113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6114:*:*:*:*:*:* Versions 6.1 6114 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6115:*:*:*:*:*:* Versions 6.1 6115 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6116:*:*:*:*:*:* Versions 6.1 6116 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6117:*:*:*:*:*:* Versions 6.1 6117 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6118:*:*:*:*:*:* Versions 6.1 6118 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6119:*:*:*:*:*:* Versions 6.1 6119 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6120:*:*:*:*:*:* Versions 6.1 6120 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24681
  2. 2026-10-03 Alias added: GHSA-gqq3-rphm-wjhv

References

Exploit 1

Patch 1

Other 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-17574 Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-11432 Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated… KEVCVSS 3.1MEDIUM 6.8
  • TI-2021-09883 Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote… CVSS 3.1CRITICAL 9.8
  • TI-2023-12890 Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a… CVSS 3.1HIGH 7.5
  • TI-2021-12772 A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus… CVSS 3.1HIGH 8.8
See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences