CVE-2024-50053

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

0.1%

top 67.45%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Servicedesk Plus Zohocorp Manageengine Servicedesk Plus MSP Zohocorp Manageengine Supportcentre Plus +3 more

Timeline

PublishedMar 21

Description

Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:NExploitability: 2.1 | Impact: 4.2

Affected Packages6 packages

▶NVDzohocorp/manageengine_servicedesk_plus< 14.9+1

▶NVDzohocorp/manageengine_servicedesk_plus_msp< 14.9+1

▶NVDzohocorp/manageengine_supportcentre_plus< 14.9+1

▶CVEListV5manageengine/servicedesk_plus14910

▶CVEListV5manageengine/servicedesk_plus_msp14900

🔴Vulnerability Details

GHSA

GHSA-8q6h-p3g8-vf5g: Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Store↗2025-03-21

▶

CVEList

Stored XSS↗2025-03-21

▶