CVE-2017-17552

HIGH

ManageEngine ADManager Plus < 6.6 - Cross-Site Request Forgery via LoadFrame src Parameter

Title source: llm

Description

/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted.

References (1)

Core 1

Core References

Exploit, Mitigation, Third Party Advisory x_refsource_misc

https://umbrielsecurity.wordpress.com/2018/01/31/dangerous-url-redirection-and-csrf-in-zoho-manageengine-ad-manager-plus-cve-2017-17552/

Scores

CVSS v3 8.8

EPSS 0.0033

EPSS Percentile 56.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (2)

zohocorp/manageengine_admanager_plus 6.6 6601 (6 CPE variants)

zohocorp/manageengine_admanager_plus < 6.6

Published Feb 07, 2018

Tracked Since Feb 18, 2026