TI-2024-33498 Aliases CVE-2024-50053 GHSA-8q6h-p3g8-vf5g

Stored XSS in ManageEngine ServiceDesk Plus

LOW 30CWE-79Published 2025-03-21 · Updated 2025-05-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01146 66th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ManageEngine	ServiceDesk Plus	up to 14910	—	No fix listed	CNA
ManageEngine	ServiceDesk Plus MSP	up to 14900	—	No fix listed	CNA
ManageEngine	SupportCentre Plus	up to 14900	—	No fix listed	CNA

ServiceDesk Plus VendorManageEngine Affected up to 14910 Fixed in — No fix listed CNA
ServiceDesk Plus MSP VendorManageEngine Affected up to 14900 Fixed in — No fix listed CNA
SupportCentre Plus VendorManageEngine Affected up to 14900 Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPE	Versions	Role	Vendor
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus::::::::	before 14.9	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.9:::::::*	14.9	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.9:14910::::::	14.9 14910	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp::::::::	before 14.9	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.9:14900::::::	14.9 14900	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_supportcentre_plus::::::::	before 14.9	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_supportcentre_plus:14.9:14900::::::	14.9 14900	Vulnerable	Zohocorp

cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:* Versions before 14.9 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.9:*:*:*:*:*:*:* Versions 14.9 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.9:14910:*:*:*:*:*:* Versions 14.9 14910 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:* Versions before 14.9 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.9:14900:*:*:*:*:*:* Versions 14.9 14900 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_supportcentre_plus:*:*:*:*:*:*:*:* Versions before 14.9 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_supportcentre_plus:14.9:14900:*:*:*:*:*:* Versions 14.9 14900 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-50053
2026-10-03 Alias added: GHSA-8q6h-p3g8-vf5g

References

Advisory 1

https://www.manageengine.com/products/service-desk/CVE-2024-50053.html

TI-2015-06796 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows… CVSS 3.0CRITICAL 9.8
TI-2014-04325 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer… CVSS 3.0HIGH 8.8
TI-2017-08514 Path traversal in Zoho ManageEngine ServiceDesk CVSS 3.0HIGH 7.5
TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
TI-2025-03383 SQL injection in ManageEngine ADSelfService Plus CVSS 3.1HIGH 8.1
TI-2025-24864 SQL injection in ManageEngine ADAudit Plus CVSS 3.1HIGH 8.3

See all 131 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences