43Zsec

**Name of the Vulnerable Software and Affected Versions** Matrix42 Service Store version 5.3 SP3 (aka 5.33.946.0) **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the query string in the SPS/Portal/default.aspx page of the Service Desk component. **Recommendations** For version 5.3 SP3 (aka 5.33.946.0), consider restricting access to the SPS/Portal/default.aspx page until a fix is available, and avoid using user-supplied input in the query string to minimize the risk of exploitation.