6.1

CVE-2019-15083

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.

Data is provided by the National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update-
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10000
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10001
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10002
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10003
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10004
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10005
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10006
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10007
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10008
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10009
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10010
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10011
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10012
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10013
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10014
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10015
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10016
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10017
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10018
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10019
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10020
Zohocorp ≫ Manageengine Servicedesk Plus Version10.0.0 Update10021
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.64% 0.811
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.