CVE-2024-38869

CWE-863 — Incorrect Authorization CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

0.1%

top 83.27%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Manageengine Endpoint Central Zohocorp Manageengine Servicedesk Plus Zohocorp Manageengine Servicedesk Plus MSP +1 more

Timeline

PublishedAug 23

Description

Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LExploitability: 2.8 | Impact: 5.5

Affected Packages4 packages

▶CVEListV5manageengine/endpoint_central< 11.3.2416.04+1

▶NVDzohocorp/manageengine_servicedesk_plus14.7+1

▶NVDzohocorp/manageengine_supportcenter_plus14.7+1

▶NVDzohocorp/manageengine_servicedesk_plus_msp14.7+1

🔴Vulnerability Details

CVEList

Incorrect Authorization↗2024-08-23

▶

GHSA

GHSA-5c96-24qg-f876: An Stored Cross-site Scripting vulnerability affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus↗2024-08-23

▶