CVEvulnerability

CVE-2024-27314

2.4 LOW Published 2024-05-27 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-05-27
Last modified
2026-06-17
Assigner
0fc0942c-577d-436f-ae8e-945763c79b02
CVSS 3.1 (0fc0942c-577d-436f-ae8e-945763c79b02)
2.4 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79

Description

Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users.

Affected configurations

• zohocorp manageengine servicedesk plus (<= 14.6) • zohocorp manageengine servicedesk plus 14.7 • zohocorp manageengine servicedesk plus msp (<= 14.6) • zohocorp manageengine servicedesk plus msp 14.7 • zohocorp manageengine supportcenter plus (<= 14.6) • zohocorp manageengine supportcenter plus 14.7

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References