Sharepoint Manager Plus
Monthly
ManageEngine SharePoint Manager Plus build 4506 and earlier fails to enforce authorization on its MFA configuration functions, so any authenticated low-privileged user can read or change MFA settings, enable or disable MFA application-wide, enumerate MFA-enrolled users, and delete MFA enrollments. This can weaken authentication protections or lock legitimate users out of the application; the vendor fixed the issue in build 4507. It is a moderate-priority issue (vuln.today Decision label: this_week) rather than an emergency, and no public exploit was identified at time of analysis.
Stored cross-site scripting in ManageEngine SharePoint Manager Plus before client build 4508 lets authenticated low-privilege users plant HTML or JavaScript in attributes used by the chart feature - users' full names, site names, and group names - which is stored and later executed in another user's browser when the affected chart is rendered. Exploitation is conditional: the attacker needs an account able to influence those fields, and the payload only fires when a victim loads the chart (UI:P), ideally a higher-privileged administrator. The vendor fixed the issue in build 4508; no public exploit was identified at time of analysis, and the vuln.today priority is this_week rather than act-now or emergency.
ManageEngine SharePoint Manager Plus build 4506 and earlier fails to enforce authorization on its MFA configuration functions, so any authenticated low-privileged user can read or change MFA settings, enable or disable MFA application-wide, enumerate MFA-enrolled users, and delete MFA enrollments. This can weaken authentication protections or lock legitimate users out of the application; the vendor fixed the issue in build 4507. It is a moderate-priority issue (vuln.today Decision label: this_week) rather than an emergency, and no public exploit was identified at time of analysis.
Stored cross-site scripting in ManageEngine SharePoint Manager Plus before client build 4508 lets authenticated low-privilege users plant HTML or JavaScript in attributes used by the chart feature - users' full names, site names, and group names - which is stored and later executed in another user's browser when the affected chart is rendered. Exploitation is conditional: the attacker needs an account able to influence those fields, and the payload only fires when a victim loads the chart (UI:P), ideally a higher-privileged administrator. The vendor fixed the issue in build 4508; no public exploit was identified at time of analysis, and the vuln.today priority is this_week rather than act-now or emergency.