CVE-2023-23077: XSS
Published Feb 1, 2023
·Updated
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
Affected Software
14 affected components
ZohoCorp ManageEngine ServiceDesk Plus=13.0
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13000
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13001
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13002
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13003
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13004
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13005
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13006
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13007
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13008
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13009
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13010
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13011
ZohoCorp ManageEngine ServiceDesk Plus=13.0-13012
Event History
Feb 1, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2023-23077?
CVE-2023-23077 is a cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13.
2
How does CVE-2023-23077 impact Zoho ManageEngine ServiceDesk Plus?
CVE-2023-23077 allows an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to account takeover or information theft.
3
What is the severity of CVE-2023-23077?
The severity of CVE-2023-23077 is medium with a CVSS score of 6.1.
4
How can I fix CVE-2023-23077?
To fix CVE-2023-23077, update Zoho ManageEngine ServiceDesk Plus to version 13.0-13012 or later.
5
Where can I find more information about CVE-2023-23077?
You can find more information about CVE-2023-23077 on the Zoho Bug Bounty website or the official ManageEngine website.