Medium · 5.4 CVE-2023-49943 EUVD-2023-53838GHSA-28q3-23hp-5939

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet.

Published Jan 18, 2024 · Updated Jun 2, 2025 · Assigned by mitre

Description

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet.

Advisories 1

WID-SEC-2024-0161 Zoho ManageEngine ServiceDesk Plus MSP: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Jan 18, 2024

References