CVE-2024-27313: 
Zoho ManageEngine PAM360 vulnerability analysis and mitigation

Zoho ManageEngine PAM360 version 6610 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on May 29, 2024, and has been assigned CVE-2024-27313 (NVD, Vendor Advisory).

The vulnerability is classified as a stored XSS issue (CWE-79: Improper Neutralization of Input During Web Page Generation). It has received a CVSS v3.1 base score of 6.3 (Medium) from ManageEngine and 4.6 (Medium) from NIST NVD, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N (NVD).

The vulnerability allows adversaries to run custom scripts and perform malicious actions on the PAM360 server (Vendor Advisory).

The vulnerability requires low attack complexity and low privileges but does need user interaction for successful exploitation. The attack can be initiated remotely over the network (NVD).

The vulnerability has been fixed in version 6611, released on April 26, 2024. Users are advised to upgrade to this version by downloading and applying the latest upgrade pack from the ManageEngine website. The fix involves removing user input from the response (Vendor Advisory).