PT-2024-5294 · Zoho · Zoho Manageengine Servicedesk Plus+1

Fabrizio · Published 2024-05-25 · Updated 2024-07-03 · CVE-2024-27314

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions below 14730 Zoho ManageEngine ServiceDesk Plus MSP versions below 14720 Zoho ManageEngine SupportCenter Plus versions below 14720

Description The vulnerability exists in the Custom Actions component of the Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus software due to inadequate protection of the web page structure. This issue can be exploited by remote attackers to conduct a stored cross-site scripting (XSS) attack, specifically in the Custom Actions menu on the request details. The vulnerability can only be exploited by users with the SDAdmin role.

Recommendations For Zoho ManageEngine ServiceDesk Plus versions below 14730, update to a version above 14730 to resolve the issue. For Zoho ManageEngine ServiceDesk Plus MSP versions below 14720, update to a version above 14720 to resolve the issue. For Zoho ManageEngine SupportCenter Plus versions below 14720, update to a version above 14720 to resolve the issue. As a temporary workaround, consider restricting access to the Custom Actions menu for SDAdmin role users until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-05917

CVE-2024-27314

Affected Products

Zoho Manageengine Servicedesk Plus

Zoho Manageengine Supportcenter Plus

References · 7

• https://bdu.fstec.ru/vul/2024-05917 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-27314 · Security Note
• https://manageengine.com/products/service-desk/cve-2024-27314.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27314 · Vendor Advisory
• https://t.me/cvenotify/81489 · Telegram Post
• https://t.me/cvenotify/82263 · Telegram Post
• https://t.me/cvenotify/81077 · Telegram Post