CVE:CVE-2018-20484
CNNVD:CNNVD-201812-1153
ZOHO ManageEngine ADSelfService Plus是美国卓豪（ZOHO）公司的一套基于Web的终端用户密码管理软件。
ZOHO ManageEngine ADSelfService Plus 5.7 build 5702之前版本中自动更新部署的实现存在跨站脚本漏洞。远程攻击者可利用该漏洞注入任意的Web脚本或HTML。
solution:Upgrade zohocorp manageengine_adselfservice_plus to a higher version than 5.7:4500,5.7:5032,5.7:5040,5.7:5041,5.7:5100,5.7:5101,5.7:5102,5.7:5103,5.7:5104,5.7:5105,5.7:5106,5.7:5107,5.7:5108,5.7:5109,5.7:5110,5.7:5111,5.7:5112,5.7:5113,5.7:5114,5.7:5115,5.7:5116,5.7:5200,5.7:5201,5.7:5202,5.7:5203,5.7:5204,5.7:5205,5.7:5206,5.7:5207,5.7:5300,5.7:5301,5.7:5302,5.7:5303,5.7:5304,5.7:5305,5.7:5306,5.7:5307,5.7:5308,5.7:5309,5.7:5310,5.7:5311,5.7:5312,5.7:5313,5.7:5314,5.7:5315,5.7:5316,5.7:5317,5.7:5318,5.7:5319,5.7:5320,5.7:5321,5.7:5322,5.7:5323,5.7:5324,5.7:5325,5.7:5326,5.7:5327,5.7:5328,5.7:5329,5.7:5330,5.7:5400,5.7:5500,5.7:5501,5.7:5502,5.7:5503,5.7:5504,5.7:5505,5.7:5506,5.7:5507,5.7:5508,5.7:5509,5.7:5510,5.7:5511,5.7:5512,5.7:5513,5.7:5514,5.7:5515,5.7:5516,5.7:5517,5.7:5518,5.7:5519,5.7:5520,5.7:5521,5.7:5600,5.7:5601,5.7:5602,5.7:5603,5.7:5604,5.7:5605,5.7:5606,5.7:5700,5.7:5701,and avoid the version 5.7:4500,5.7:5032,5.7:5040,5.7:5041,5.7:5100,5.7:5101,5.7:5102,5.7:5103,5.7:5104,5.7:5105,5.7:5106,5.7:5107,5.7:5108,5.7:5109,5.7:5110,5.7:5111,5.7:5112,5.7:5113,5.7:5114,5.7:5115,5.7:5116,5.7:5200,5.7:5201,5.7:5202,5.7:5203,5.7:5204,5.7:5205,5.7:5206,5.7:5207,5.7:5300,5.7:5301,5.7:5302,5.7:5303,5.7:5304,5.7:5305,5.7:5306,5.7:5307,5.7:5308,5.7:5309,5.7:5310,5.7:5311,5.7:5312,5.7:5313,5.7:5314,5.7:5315,5.7:5316,5.7:5317,5.7:5318,5.7:5319,5.7:5320,5.7:5321,5.7:5322,5.7:5323,5.7:5324,5.7:5325,5.7:5326,5.7:5327,5.7:5328,5.7:5329,5.7:5330,5.7:5400,5.7:5500,5.7:5501,5.7:5502,5.7:5503,5.7:5504,5.7:5505,5.7:5506,5.7:5507,5.7:5508,5.7:5509,5.7:5510,5.7:5511,5.7:5512,5.7:5513,5.7:5514,5.7:5515,5.7:5516,5.7:5517,5.7:5518,5.7:5519,5.7:5520,5.7:5521,5.7:5600,5.7:5601,5.7:5602,5.7:5603,5.7:5604,5.7:5605,5.7:5606,5.7:5700,5.7:5701