PT-2023-18832 · Zoho · Zoho Manageengine Servicedesk Plus

Hms

·

CVE-2023-23073

·

Published

2023-02-01

·

Updated

2023-02-14

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 14
Description The issue is a cross site scripting (XSS) vulnerability. It affects the purchase component via PO.
Recommendations For Zoho ManageEngine ServiceDesk Plus version 14, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the purchase component to minimize the risk of exploitation.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-23073

Affected Products

Zoho Manageengine Servicedesk Plus