Cross Site Scripting Vulnerability in Zoho ManageEngine ServiceDesk Plus
CVE-2023-23074

6.1MEDIUM

Key Information:

Vendor

Zohocorp
Status
Manageengine Servicedesk Plus
Vendor
CVE Published:
1 February 2023

What is CVE-2023-23074?

A Cross Site Scripting (XSS) vulnerability exists in Zoho ManageEngine ServiceDesk Plus 14 that allows attackers to inject malicious scripts by embedding videos within the language component. This could lead to unauthorized actions being performed on behalf of users, exposing sensitive information and compromising system integrity. Organizations using the affected version should take immediate measures to mitigate the risks associated with this vulnerability.

References

https://bugbounty.zohocorp.com/bb/#/bug/101000006459195?t...
https://www.manageengine.com/products/service-desk/CVE-20...

EPSS Score

87% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.