CVE-2019-15083

Katalog CVE

CVSS 6.1 · Medium EPSS 6,3%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada zohocorp manageengine servicedesk plus. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.

Rincian

Terbit di NVD

14 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

6,3% peluang dieksploitasi; lebih tinggi dari 93,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.manageengine.com/products/service-desk/on-premises/readme.html#readme105 release notes · advisory vendor
• https://www.manageengine.com/products/service-desk/readme.html release notes · advisory vendor
• http://packetstormsecurity.com/files/157717/ManageEngine-Service-Desk-10.0-Cross-Site-Scripting.html advisory pihak ketiga
• https://www.exploit-db.com/exploits/48473 advisory pihak ketiga