Low severity · published May 27, 2024
CVE-2024-27314
Stored XSS Vulnerability
2.4
CVSS
1.9%
EPSS
No
On KEV
Description
Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus · ManageEngine
before 14730 · source: vendor
MS
Manageengine Servicedesk Plus · Zohocorp
through 14.6; 14.7; 14.7; 14.7 · source: NVD
MS
Manageengine Servicedesk Plus Msp · Zohocorp
through 14.6; 14.7; 14.7 · source: NVD
MS
Manageengine Supportcenter Plus · Zohocorp
through 14.6; 14.7; 14.7 · source: NVD
SP
Servicedesk Plus · Manageengine
before 14730 · source: CISA
SE
Servicedeskplusmsp · Manageengine
before 14730 · source: CISA
SP
Supportcenter Plus · Manageengine
before 14730 · source: CISA
Affected product
SP
ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus
ManageEngine