ZOHO ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability (CNVD-2021-94824)

ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. used to allow organizations to effectively manage customer requests, their account and contact information, service contracts, and provide a superior customer experience in the process.A cross-site scripting vulnerability exists in ZOHO ManageEngine SupportCenter Plus, which stems from the product’s Products module not validating user identities, and could be exploited by an attacker to to steal the victim’s cookie-based authentication credentials.