Read the docs
TI-2019-11261 Aliases CVE-2019-15083GHSA-4wr2-m35f-fgqf

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are…

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.

Why it matters now

EPSS 0.06301 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:-:*:*:*:*:*:*10.0.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10000:*:*:*:*:*:*10.0.0 10000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10001:*:*:*:*:*:*10.0.0 10001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10002:*:*:*:*:*:*10.0.0 10002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10003:*:*:*:*:*:*10.0.0 10003VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10004:*:*:*:*:*:*10.0.0 10004VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10005:*:*:*:*:*:*10.0.0 10005VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10006:*:*:*:*:*:*10.0.0 10006VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10007:*:*:*:*:*:*10.0.0 10007VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10008:*:*:*:*:*:*10.0.0 10008VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:-:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10000:*:*:*:*:*:* Versions 10.0.0 10000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10001:*:*:*:*:*:* Versions 10.0.0 10001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10002:*:*:*:*:*:* Versions 10.0.0 10002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10003:*:*:*:*:*:* Versions 10.0.0 10003 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10004:*:*:*:*:*:* Versions 10.0.0 10004 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10005:*:*:*:*:*:* Versions 10.0.0 10005 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10006:*:*:*:*:*:* Versions 10.0.0 10006 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10007:*:*:*:*:*:* Versions 10.0.0 10007 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10008:*:*:*:*:*:* Versions 10.0.0 10008 Vulnerable ·Zohocorp
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10009:*:*:*:*:*:*10.0.0 10009VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10010:*:*:*:*:*:*10.0.0 10010VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10011:*:*:*:*:*:*10.0.0 10011VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10012:*:*:*:*:*:*10.0.0 10012VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10013:*:*:*:*:*:*10.0.0 10013VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10014:*:*:*:*:*:*10.0.0 10014VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10015:*:*:*:*:*:*10.0.0 10015VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10016:*:*:*:*:*:*10.0.0 10016VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10017:*:*:*:*:*:*10.0.0 10017VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10018:*:*:*:*:*:*10.0.0 10018VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10019:*:*:*:*:*:*10.0.0 10019VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10020:*:*:*:*:*:*10.0.0 10020VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10021:*:*:*:*:*:*10.0.0 10021VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10009:*:*:*:*:*:* Versions 10.0.0 10009 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10010:*:*:*:*:*:* Versions 10.0.0 10010 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10011:*:*:*:*:*:* Versions 10.0.0 10011 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10012:*:*:*:*:*:* Versions 10.0.0 10012 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10013:*:*:*:*:*:* Versions 10.0.0 10013 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10014:*:*:*:*:*:* Versions 10.0.0 10014 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10015:*:*:*:*:*:* Versions 10.0.0 10015 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10016:*:*:*:*:*:* Versions 10.0.0 10016 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10017:*:*:*:*:*:* Versions 10.0.0 10017 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10018:*:*:*:*:*:* Versions 10.0.0 10018 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10019:*:*:*:*:*:* Versions 10.0.0 10019 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10020:*:*:*:*:*:* Versions 10.0.0 10020 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10021:*:*:*:*:*:* Versions 10.0.0 10021 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-15083
  2. 2026-10-03 Alias added: GHSA-4wr2-m35f-fgqf

References

Advisory 4

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19808 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-15358 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-06025 Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers… KEVCVSS 3.1HIGH 7.5
  • TI-2022-19395 Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to… CVSS 3.1HIGH 7.2
  • TI-2021-03384 Cross-site scripting in ManageEngine ServiceDesk Plus CVSS 3.1MEDIUM 6.1
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences