Read the docs
TI-2023-09132 Aliases CVE-2023-23075GHSA-j282-28jg-23rq

Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential…

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02625 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:-:*:*:*:*:*:*6.9VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6900:*:*:*:*:*:*6.9 6900VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6901:*:*:*:*:*:*6.9 6901VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6902:*:*:*:*:*:*6.9 6902VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6903:*:*:*:*:*:*6.9 6903VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6904:*:*:*:*:*:*6.9 6904VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6905:*:*:*:*:*:*6.9 6905VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6906:*:*:*:*:*:*6.9 6906VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6907:*:*:*:*:*:*6.9 6907VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6908:*:*:*:*:*:*6.9 6908VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:-:*:*:*:*:*:* Versions 6.9 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6900:*:*:*:*:*:* Versions 6.9 6900 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6901:*:*:*:*:*:* Versions 6.9 6901 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6902:*:*:*:*:*:* Versions 6.9 6902 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6903:*:*:*:*:*:* Versions 6.9 6903 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6904:*:*:*:*:*:* Versions 6.9 6904 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6905:*:*:*:*:*:* Versions 6.9 6905 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6906:*:*:*:*:*:* Versions 6.9 6906 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6907:*:*:*:*:*:* Versions 6.9 6907 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6908:*:*:*:*:*:* Versions 6.9 6908 Vulnerable ·Zohocorp
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6909:*:*:*:*:*:*6.9 6909VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6950:*:*:*:*:*:*6.9 6950VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6951:*:*:*:*:*:*6.9 6951VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6952:*:*:*:*:*:*6.9 6952VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6953:*:*:*:*:*:*6.9 6953VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6954:*:*:*:*:*:*6.9 6954VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6955:*:*:*:*:*:*6.9 6955VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6956:*:*:*:*:*:*6.9 6956VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6957:*:*:*:*:*:*6.9 6957VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6970:*:*:*:*:*:*6.9 6970VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6971:*:*:*:*:*:*6.9 6971VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6972:*:*:*:*:*:*6.9 6972VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6973:*:*:*:*:*:*6.9 6973VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6974:*:*:*:*:*:*6.9 6974VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6975:*:*:*:*:*:*6.9 6975VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6976:*:*:*:*:*:*6.9 6976VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6977:*:*:*:*:*:*6.9 6977VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6978:*:*:*:*:*:*6.9 6978VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6979:*:*:*:*:*:*6.9 6979VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6980:*:*:*:*:*:*6.9 6980VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6981:*:*:*:*:*:*6.9 6981VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6982:*:*:*:*:*:*6.9 6982VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6983:*:*:*:*:*:*6.9 6983VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6984:*:*:*:*:*:*6.9 6984VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6985:*:*:*:*:*:*6.9 6985VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6986:*:*:*:*:*:*6.9 6986VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6987:*:*:*:*:*:*6.9 6987VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6988:*:*:*:*:*:*6.9 6988VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6909:*:*:*:*:*:* Versions 6.9 6909 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6950:*:*:*:*:*:* Versions 6.9 6950 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6951:*:*:*:*:*:* Versions 6.9 6951 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6952:*:*:*:*:*:* Versions 6.9 6952 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6953:*:*:*:*:*:* Versions 6.9 6953 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6954:*:*:*:*:*:* Versions 6.9 6954 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6955:*:*:*:*:*:* Versions 6.9 6955 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6956:*:*:*:*:*:* Versions 6.9 6956 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6957:*:*:*:*:*:* Versions 6.9 6957 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6970:*:*:*:*:*:* Versions 6.9 6970 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6971:*:*:*:*:*:* Versions 6.9 6971 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6972:*:*:*:*:*:* Versions 6.9 6972 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6973:*:*:*:*:*:* Versions 6.9 6973 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6974:*:*:*:*:*:* Versions 6.9 6974 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6975:*:*:*:*:*:* Versions 6.9 6975 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6976:*:*:*:*:*:* Versions 6.9 6976 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6977:*:*:*:*:*:* Versions 6.9 6977 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6978:*:*:*:*:*:* Versions 6.9 6978 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6979:*:*:*:*:*:* Versions 6.9 6979 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6980:*:*:*:*:*:* Versions 6.9 6980 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6981:*:*:*:*:*:* Versions 6.9 6981 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6982:*:*:*:*:*:* Versions 6.9 6982 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6983:*:*:*:*:*:* Versions 6.9 6983 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6984:*:*:*:*:*:* Versions 6.9 6984 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6985:*:*:*:*:*:* Versions 6.9 6985 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6986:*:*:*:*:*:* Versions 6.9 6986 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6987:*:*:*:*:*:* Versions 6.9 6987 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6988:*:*:*:*:*:* Versions 6.9 6988 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23075
  2. 2026-10-03 Alias added: GHSA-j282-28jg-23rq

References

Advisory 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-11733 Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987… CVSS 3.1HIGH 7.5
  • TI-2021-03410 Integer overflow in Manage Engine Asset Explorer Agent CVSS 3.1CRITICAL 9.8
  • TI-2019-09733 Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version… CVSS 3.0CRITICAL 9.1
  • TI-2019-10915 Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection… CVSS 3.0HIGH 8.5
  • TI-2019-09702 Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and… CVSS 3.0HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences