fkie_cve-2023-23077
Vulnerability from fkie_nvd
Published
2023-02-01 20:15
Modified
2024-11-21 07:45
Severity ?
Summary
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:-:*:*:*:*:*:*",
"matchCriteriaId": "F47FA243-5596-4E18-B7FA-F3301F5ADF0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13000:*:*:*:*:*:*",
"matchCriteriaId": "B0B75973-355C-447E-BBEA-18459A5736C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13001:*:*:*:*:*:*",
"matchCriteriaId": "7E45A9C9-EE09-493E-AE75-BACCD86B97EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13002:*:*:*:*:*:*",
"matchCriteriaId": "4509077B-AD20-49B3-B23D-A0BC9E7A07E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13003:*:*:*:*:*:*",
"matchCriteriaId": "2B5066A4-D8F9-452D-9686-49B5B33EE326",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13004:*:*:*:*:*:*",
"matchCriteriaId": "A221A081-71CD-437F-9FE2-6A255A816BD3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13005:*:*:*:*:*:*",
"matchCriteriaId": "883692B3-A95D-46F5-9E52-7694AF30CBAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13006:*:*:*:*:*:*",
"matchCriteriaId": "D3C36A1A-9E47-4343-936A-711C7234D125",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13007:*:*:*:*:*:*",
"matchCriteriaId": "D7875DEA-DE8F-4AF1-BCE7-FDF2A59C1DED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13008:*:*:*:*:*:*",
"matchCriteriaId": "702DC6C6-7EC3-4897-96E5-4F7DAED23170",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13009:*:*:*:*:*:*",
"matchCriteriaId": "F4D2A501-3100-484B-A0B9-7BD10DB9D14A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13010:*:*:*:*:*:*",
"matchCriteriaId": "A2E24BFE-8EA8-4CDF-991B-A005E299518D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13011:*:*:*:*:*:*",
"matchCriteriaId": "93E24D9D-333B-4EAB-AD78-E568FE2C07EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13012:*:*:*:*:*:*",
"matchCriteriaId": "CF090E94-1878-400A-8E4E-26F2E1161A2A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment."
}
],
"id": "CVE-2023-23077",
"lastModified": "2024-11-21T07:45:50.440",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-02-01T20:15:12.170",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Not Applicable",
"Vendor Advisory"
],
"url": "https://bugbounty.zohocorp.com/bb/#/bug/101000006387693?tab=originator"
},
{
"source": "cve@mitre.org",
"url": "https://www.manageengine.com/products/service-desk/CVE-2023-23077.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Not Applicable",
"Vendor Advisory"
],
"url": "https://bugbounty.zohocorp.com/bb/#/bug/101000006387693?tab=originator"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.manageengine.com/products/service-desk/CVE-2023-23077.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.