Stored XSS in ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus
Priority LOW 16CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01908 79th percentileScored 2026-11-07
Fix Fixed ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus (ManageEngine): 14730
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ManageEngine | ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus | before 14730 | 14730 | Patch available | CNA |
- ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus VendorManageEngine Affected before 14730 Fixed in 14730 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:* | up to 14.6 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14700:*:*:*:*:*:* | 14.7 14700 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14710:*:*:*:*:*:* | 14.7 14710 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14720:*:*:*:*:*:* | 14.7 14720 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:* | up to 14.6 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.7:14700:*:*:*:*:*:* | 14.7 14700 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.7:14710:*:*:*:*:*:* | 14.7 14710 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:* | up to 14.6 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.7:14700:*:*:*:*:*:* | 14.7 14700 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.7:14710:*:*:*:*:*:* | 14.7 14710 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:* Versions up to 14.6 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14700:*:*:*:*:*:* Versions 14.7 14700 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14710:*:*:*:*:*:* Versions 14.7 14710 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14720:*:*:*:*:*:* Versions 14.7 14720 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:* Versions up to 14.6 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.7:14700:*:*:*:*:*:* Versions 14.7 14700 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.7:14710:*:*:*:*:*:* Versions 14.7 14710 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:* Versions up to 14.6 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.7:14700:*:*:*:*:*:* Versions 14.7 14700 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.7:14710:*:*:*:*:*:* Versions 14.7 14710 Vulnerable ·Zohocorp
Remediation
- Fix · CNA ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus (ManageEngine) Fixed in 14730
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27314
References
More ManageEngine vulnerabilities
- TI-2015-06796 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows… CVSS 3.0CRITICAL 9.8
- TI-2014-04325 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer… CVSS 3.0HIGH 8.8
- TI-2017-08514 Path traversal in Zoho ManageEngine ServiceDesk CVSS 3.0HIGH 7.5
- TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
- TI-2025-03383 SQL injection in ManageEngine ADSelfService Plus CVSS 3.1HIGH 8.1
- TI-2025-24864 SQL injection in ManageEngine ADAudit Plus CVSS 3.1HIGH 8.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences