{"api_version":"1","generated_at":"2026-07-23T23:42:08+00:00","cve":"CVE-2020-27449","urls":{"html":"https://cve.report/CVE-2020-27449","api":"https://cve.report/api/cve/CVE-2020-27449.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-27449","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-27449"},"summary":{"title":"CVE-2020-27449","description":"Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2023-08-11 14:15:00","updated_at":"2023-08-16 15:37:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://bugbounty.zoho.com/bb/#/bug/101000003619211","name":"https://bugbounty.zoho.com/bb/#/bug/101000003619211","refsource":"MISC","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002","name":"https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002","refsource":"MISC","tags":[],"title":"Release Notes - ManageEngine Password Manager Pro","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27449","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27449","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"27449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zohocorp","cpe5":"manageengine_password_manager_pro","cpe6":"11.1","cpe7":"build_11101","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2020-27449","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://bugbounty.zoho.com/bb/#/bug/101000003619211","refsource":"MISC","name":"https://bugbounty.zoho.com/bb/#/bug/101000003619211"},{"refsource":"MISC","name":"https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002","url":"https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11002"}]}},"nvd":{"publishedDate":"2023-08-11 14:15:00","lastModifiedDate":"2023-08-16 15:37:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1:build_11101:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"27449","Ordinal":"188883","Title":"CVE-2020-27449","CVE":"CVE-2020-27449","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"27449","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}