Medium severity · published Apr 2, 2018
CVE-2018-9163
A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician…
5.4
CVSS
4.8%
EPSS
No
On KEV
Description
A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
Manageengine Recovery Manager Plus · Zohocorp
before 5.3 · source: NVD
Affected product
MR
Manageengine Recovery Manager Plus
Zohocorp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-9163
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-9163
Third Party Advisory
http://www.securityfocus.com/bid/103773
Exploit
https://gurelahmet.com/cve-2018-9163-zoho-manageengine-recovery-manager-plus-5-3-build-5330-stored-cross-site-scripting-xss-vulnerability/
Third Party Advisory
https://www.exploit-db.com/exploits/44666/
Release Notes
https://www.manageengine.com/ad-recovery-manager/release-notes.html#5350
More from Manageengine Recovery Manager Plus
9.0
CVE-2026-11374
Account Takeover via Predictable SSO Ticket Generation