Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet.
References
Link | Resource |
---|---|
https://manageengine.com | Product |
https://www.manageengine.com/products/service-desk-msp/CVE-2023-49943.html | Vendor Advisory |
https://manageengine.com | Product |
https://www.manageengine.com/products/service-desk-msp/CVE-2023-49943.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:34
Type | Values Removed | Values Added |
---|---|---|
References | () https://manageengine.com - Product | |
References | () https://www.manageengine.com/products/service-desk-msp/CVE-2023-49943.html - Vendor Advisory |
25 Jan 2024, 15:35
Type | Values Removed | Values Added |
---|---|---|
References | () https://www.manageengine.com/products/service-desk-msp/CVE-2023-49943.html - Vendor Advisory | |
References | () https://manageengine.com - Product | |
CPE | cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14500:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14502:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14501:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.5:14503:*:*:*:*:*:* |
|
CWE | CWE-79 | |
First Time |
Zohocorp manageengine Servicedesk Plus Msp
Zohocorp |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
18 Jan 2024, 19:25
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-01-18 19:15
Updated : 2024-11-21 08:34
NVD link : CVE-2023-49943
Mitre link : CVE-2023-49943
CVE.ORG link : CVE-2023-49943
JSON object : View
Products Affected
zohocorp
- manageengine_servicedesk_plus_msp
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')