Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-12543 — Cross-site Scripting in Manageengine Servicedesk Plus

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
1.7%
top 17.71%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Zohocorp Manageengine Servicedesk Plus
Timeline
PublishedJun 5
Latest updateMay 24

Description

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-5wjc-p3mr-28xf: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9↗2022-05-24
▶
CVEList
CVE-2019-12543: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9↗2019-06-05
▶

💥Exploits & PoCs

1
Exploit-DB
Zoho ManageEngine ServiceDesk Plus 9.3 - 'PurchaseRequest.do' Cross-Site Scripting↗2019-06-04
▶
CVE-2019-12543 — Cross-site Scripting | cvebase