Reflected XSS Vulnerability in Zoho ManageEngine SupportCenter Plus
CVE-2021-43294

6.1MEDIUM

Key Information:

Vendor

Zohocorp
Status
Manageengine Supportcenter Plus
Vendor
CVE Published:
30 November 2021

What is CVE-2021-43294?

Zoho ManageEngine SupportCenter Plus prior to version 11016 is exposed to a reflected cross-site scripting (XSS) vulnerability within the Products module. This flaw allows attackers to inject malicious scripts via user input, potentially leading to unauthorized actions and data exposure for unsuspecting users interacting with the affected module. Users and administrators are advised to upgrade to the latest version to mitigate this risk.

References

https://manageengine.com
x_refsource_MISC
https://www.manageengine.com/products/support-center/read...
x_refsource_CONFIRM

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.