CVE-2023-49943

2024-01-1819:15:09

CWE-79

[email protected]

web.nvd.nist.gov

zoho

servicedesk plus

xss

vulnerability

task name.

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.01

Percentile

83.8%

JSON

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task’s name in a time sheet.

Affected configurations

Nvd

Node

zohocorpmanageengine_servicedesk_plus_mspRange<14.5

zohocorpmanageengine_servicedesk_plus_mspMatch14.514500

zohocorpmanageengine_servicedesk_plus_mspMatch14.514501

zohocorpmanageengine_servicedesk_plus_mspMatch14.514502

zohocorpmanageengine_servicedesk_plus_mspMatch14.514503

VendorProductVersionCPE
zohocorpmanageengine_servicedesk_plus_msp*cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus_msp14.5cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14500:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus_msp14.5cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14501:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus_msp14.5cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14502:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus_msp14.5cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14503:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_servicedesk_plus_msp	*	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp::::::::
zohocorp	manageengine_servicedesk_plus_msp	14.5	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14500::::::
zohocorp	manageengine_servicedesk_plus_msp	14.5	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14501::::::
zohocorp	manageengine_servicedesk_plus_msp	14.5	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14502::::::
zohocorp	manageengine_servicedesk_plus_msp	14.5	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14503::::::