Low severity · published May 27, 2024
CVE-2024-27314
Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions…
2.4
CVSS
1.9%
EPSS
No
On KEV
Description
Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Manageengine Servicedesk Plus · Zohocorp
through 14.6; 14.7; 14.7; 14.7 · source: NVD
MS
Manageengine Servicedesk Plus Msp · Zohocorp
through 14.6; 14.7; 14.7 · source: NVD
MS
Manageengine Supportcenter Plus · Zohocorp
through 14.6; 14.7; 14.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-27314
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-27314
Vendor Advisory
https://www.manageengine.com/products/service-desk/cve-2024-27314.html
More from Manageengine Servicedesk Plus
9.8
CVE-2022-47966
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
9.8
CVE-2021-44077
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
9.8
CVE-2021-37415
Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
6.5
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
9.8
CVE-2021-44526
Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations