Read the docs
TI-2023-09135 Aliases CVE-2023-23078GHSA-5rfp-9wcc-x567

Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the…

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02813 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:-:*:*:*:*:*:*14.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14000:*:*:*:*:*:*14.0 14000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14001:*:*:*:*:*:*14.0 14001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14002:*:*:*:*:*:*14.0 14002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14003:*:*:*:*:*:*14.0 14003VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14004:*:*:*:*:*:*14.0 14004VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14005:*:*:*:*:*:*14.0 14005VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14006:*:*:*:*:*:*14.0 14006VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:-:*:*:*:*:*:* Versions 14.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14000:*:*:*:*:*:* Versions 14.0 14000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14001:*:*:*:*:*:* Versions 14.0 14001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14002:*:*:*:*:*:* Versions 14.0 14002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14003:*:*:*:*:*:* Versions 14.0 14003 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14004:*:*:*:*:*:* Versions 14.0 14004 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14005:*:*:*:*:*:* Versions 14.0 14005 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14006:*:*:*:*:*:* Versions 14.0 14006 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23078
  2. 2026-10-03 Alias added: GHSA-5rfp-9wcc-x567

References

Advisory 1

Other 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19808 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-15358 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-06025 Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers… KEVCVSS 3.1HIGH 7.5
  • TI-2022-19395 Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to… CVSS 3.1HIGH 7.2
  • TI-2021-03384 Cross-site scripting in ManageEngine ServiceDesk Plus CVSS 3.1MEDIUM 6.1
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences