CVE-2023-23078

2023-02-0120:15:12

CWE-79

[email protected]

web.nvd.nist.gov

cross site scripting

zoho manageengine

servicedesk plus 14

comment field

changing credentials

assets

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.003

Percentile

69.2%

JSON

Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.

Affected configurations

Nvd

Node

zohocorpmanageengine_servicedesk_plusMatch14.0-

zohocorpmanageengine_servicedesk_plusMatch14.014000

zohocorpmanageengine_servicedesk_plusMatch14.014001

zohocorpmanageengine_servicedesk_plusMatch14.014002

zohocorpmanageengine_servicedesk_plusMatch14.014003

zohocorpmanageengine_servicedesk_plusMatch14.014004

zohocorpmanageengine_servicedesk_plusMatch14.014005

zohocorpmanageengine_servicedesk_plusMatch14.014006

VendorProductVersionCPE
zohocorpmanageengine_servicedesk_plus14.0cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:-:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus14.0cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14000:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus14.0cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14001:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus14.0cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14002:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus14.0cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14003:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus14.0cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14004:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus14.0cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14005:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus14.0cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14006:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_servicedesk_plus	14.0	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:-::::::
zohocorp	manageengine_servicedesk_plus	14.0	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14000::::::
zohocorp	manageengine_servicedesk_plus	14.0	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14001::::::
zohocorp	manageengine_servicedesk_plus	14.0	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14002::::::
zohocorp	manageengine_servicedesk_plus	14.0	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14003::::::
zohocorp	manageengine_servicedesk_plus	14.0	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14004::::::
zohocorp	manageengine_servicedesk_plus	14.0	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14005::::::
zohocorp	manageengine_servicedesk_plus	14.0	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14006::::::