CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zoho Campaigns allows Cross-Site Scripting (XSS).This issue affects Zoho Campaigns: from n/a through 2.0.8.
Explanation of Vulnerability in Simple Terms
Zoho Campaigns versions up to 2.0.8 contain a cross-site scripting vulnerability that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction and affects the integrity and confidentiality of data. The impact extends beyond the vulnerable component due to scope change.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they interact with the application.
Potential impact on your site
Authenticated users' sessions and data can be compromised if they interact with attacker-controlled content within Zoho Campaigns.
Conditions required to exploit
Attacker must be authenticated with low-level privileges and the victim must click a malicious link or visit a crafted page.
Key dates
External resources
Related vulnerabilities
