CVE-2021-40178: 
Zoho ManageEngine Log360 vulnerability analysis and mitigation

Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings (NVD, Release Notes).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability stems from improper validation of the LOGO_PATH key value in the logon settings, which allows for stored XSS attacks (NVD).

The vulnerability allows attackers to inject malicious JavaScript code that executes in users' browsers when they access the logon settings page. This could lead to theft of sensitive information and potential manipulation of the application's interface (NVD).

The vulnerability requires user interaction to be exploited, as indicated by the CVSS metrics. An attacker would need to inject malicious code via the LOGO_PATH key value, which would then be stored and executed when users access the affected page (NVD).

The vulnerability has been fixed in Build 5224. Users should upgrade to this version or later to address the security issue. The fix includes proper validation of the LOGO_PATH key value in the logon settings (Release Notes).