CVE-2019-15083 — MEDIUM (6.1)

Vulnerability Description

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Zohocorp	Manageengine Servicedesk Plus	10.0.0

Related Weaknesses (CWE)

CWE-79

References

http://packetstormsecurity.com/files/157717/ManageEngine-Service-Desk-10.0-CrossThird Party Advisory
https://www.exploit-db.com/exploits/48473Third Party Advisory
https://www.manageengine.com/products/service-desk/on-premises/readme.html#readmRelease NotesVendor Advisory
https://www.manageengine.com/products/service-desk/readme.htmlRelease NotesVendor Advisory
http://packetstormsecurity.com/files/157717/ManageEngine-Service-Desk-10.0-CrossThird Party Advisory
https://www.exploit-db.com/exploits/48473Third Party Advisory
https://www.manageengine.com/products/service-desk/on-premises/readme.html#readmRelease NotesVendor Advisory
https://www.manageengine.com/products/service-desk/readme.htmlRelease NotesVendor Advisory

FAQ

What is CVE-2019-15083?

CVE-2019-15083 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as ...

How severe is CVE-2019-15083?

CVE-2019-15083 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-15083?

Check the references section above for vendor advisories and patch information. Affected products include: Zohocorp Manageengine Servicedesk Plus.