CVE-2019-15083: XSS
Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.
Affected Software
Event History
Frequently Asked Questions
What is vulnerability CVE-2019-15083?
Vulnerability CVE-2019-15083 is a cross-site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 10.0 before 10500.
How severe is vulnerability CVE-2019-15083?
Vulnerability CVE-2019-15083 has a severity score of 6.1 (medium).
What is the affected software versions for vulnerability CVE-2019-15083?
The affected software versions for vulnerability CVE-2019-15083 are Zoho ManageEngine ServiceDesk Plus 10.0.0 to 10.0.0-10021.
How can an attacker exploit vulnerability CVE-2019-15083?
An attacker with local administrator privileges can inject cross-site scripting (XSS) payloads using the installed program names of the computer as a vector, allowing them to execute malicious code on the Manage Engine ServiceDesk administrator site.
Are there any fixes or patches available for vulnerability CVE-2019-15083?
Yes, Zoho has released a patch for this vulnerability. It is recommended to update to Zoho ManageEngine ServiceDesk Plus version 10.5.0 or later.