PT-2020-9656 · Zoho · Zoho Manageengine Servicedesk Plus

Published 2020-05-14 · Updated 2020-05-19 · CVE-2019-15083

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 10.0 before 10500

Description The issue allows a local administrator to inject malicious code into the installed program names of a computer, which can then be executed on the ManageEngine ServiceDesk administrator side when the administrator views the "Asset Home > Server > > software" page. This page displays all installed program names in the Software column, providing a vector for the local administrator to execute code. A remote attacker can exploit this to inject malicious code, which will be executed when the ManageEngine administrator visualizes this page.

Recommendations For Zoho ManageEngine ServiceDesk Plus version 10.0 before 10500, update to a version 10500 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Asset Home > Server > > software" page until the update is applied. Additionally, restrict the ability of local administrators to modify installed program names to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-15083

Affected Products

Zoho Manageengine Servicedesk Plus

References · 7

• 🔥 https://exploit-db.com/exploits/48473 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15083 · Security Note
• https://manageengine.com/products/service-desk/readme.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15083 · Vendor Advisory
• https://manageengine.com/products/service-desk/on-premises/readme.html#readme105 · Vendor Advisory
• http://packetstormsecurity.com/files/157717/ManageEngine-Service-Desk-10.0-Cross-Site-Scripting.html · Note
• https://t.me/cibsecurity/12066 · Telegram Post