CVE-2024-27314

EUVD-2024-24530
Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.4 LOW
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
ManageEngineCNA
2.4 LOW
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 87%
Affected Products (NVD)
VendorProductVersion
zohocorpmanageengine_servicedesk_plus
𝑥
≤ 14.6
zohocorpmanageengine_servicedesk_plus
14.7:14700
zohocorpmanageengine_servicedesk_plus
14.7:14710
zohocorpmanageengine_servicedesk_plus
14.7:14720
zohocorpmanageengine_servicedesk_plus_msp
𝑥
≤ 14.6
zohocorpmanageengine_servicedesk_plus_msp
14.7:14700
zohocorpmanageengine_servicedesk_plus_msp
14.7:14710
zohocorpmanageengine_supportcenter_plus
𝑥
≤ 14.6
zohocorpmanageengine_supportcenter_plus
14.7:14700
zohocorpmanageengine_supportcenter_plus
14.7:14710
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.manageengine.com/products/service-desk/cve-2024-27314.html
https://www.manageengine.com/products/service-desk/cve-2024-27314.html