Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-15083 — Cross-site Scripting in Manageengine Servicedesk Plus

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
1.9%
top 16.72%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Zohocorp Manageengine Servicedesk Plus
Timeline
PublishedMay 14
Latest updateMay 24

Description

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-4wr2-m35f-fgqf: Default installations of Zoho ManageEngine ServiceDesk Plus 10↗2022-05-24
▶
CVEList
CVE-2019-15083: Default installations of Zoho ManageEngine ServiceDesk Plus 10↗2020-05-14
▶

💥Exploits & PoCs

1
Exploit-DB
ManageEngine Service Desk 10.0 - Cross-Site Scripting↗2020-05-15
▶
CVE-2019-15083 — Cross-site Scripting | cvebase