CVE-2017-17552

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-02-07 · updated 2026-06-17
Weakness: CWE-352

Description

/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted.

Affected products

Zohocorp ManageEngine ADManager Plus: before 6.6; 6.6-6601, 6.6-6602, 6.6-6610, 6.6-6611, 6.6-6612, 6.6-6613 — fixed in 6.6

How to fix

Upgrade to a fixed version: Zohocorp ManageEngine ADManager Plus 6.6. Check the vendor advisory for mitigations.

References

https://umbrielsecurity.wordpress.com/2018/01/31/dangerous-url-redirection-and-csrf-in-zoho-manageengine-ad-manager-plus-cve-2017-17552/
https://umbrielsecurity.wordpress.com/2018/01/31/dangerous-url-redirection-and-csrf-in-zoho-manageengine-ad-manager-plus-cve-2017-17552/

Get alerted when CVE-2017-17552 or the next vulnerability affects your stack