Skip to content
OpenAdvisories
Low WID-SEC-2023-0254 4 CVEs

Zoho ManageEngine ServiceDesk Plus: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Feb 1, 2023 · Updated Feb 1, 2023 · de-DE

Vendor: Zoho Product: ManageEngine ServiceDesk Plus 14 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Zoho ManageEngine ServiceDesk Plus ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

ManageEngine ServiceDesk Plus ist eine Helpdesk- und Asset-Management-Software.

Vulnerabilities 4

  • Medium 6.1
    CVE-2023-23073

    Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.

  • Medium 6.1
    CVE-2023-23074 EPSS 84%

    Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language …

  • Medium 6.1
    CVE-2023-23077

    Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a n…

  • Medium 6.1
    CVE-2023-23078

    Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing t…

Revision history

  1. #1

    Initiale Fassung

References