CVE-2021-36771: 
Zoho ManageEngine ADManager Plus vulnerability analysis and mitigation

Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS (Cross-Site Scripting). This vulnerability was discovered and disclosed in July 2021 (NVD, Release Notes).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has a CVSS v3.1 Base Score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability requires user interaction and can be exploited remotely (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute malicious JavaScript code in a victim's browser context, potentially leading to theft of sensitive information or manipulation of web content. The vulnerability affects confidentiality and integrity but does not impact availability (NVD).

The vulnerability can be exploited by an unauthenticated attacker with network access. However, successful exploitation requires user interaction, such as clicking on a malicious link or visiting a compromised page (NVD).

The vulnerability has been fixed in ADManager Plus version 7110. Users are advised to upgrade to this version or later to mitigate the risk (Release Notes).