CVE-2024-27314CWE-79

Stored XSS Vulnerability

Low · published May 27, 2024

CVSS v3.1
2.4
EPSS
2%
Percentile
79.6
In the wild
Unconfirmed
What it is

Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users.

The record
Technical detail
CVSS v3.1
2.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01908 · 79.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-27T07:03Z
EPSS history
Timeline
  • 27 MAY 07:03Z
    Stored XSS Vulnerability
    cvelistv5