# Security Updates - CVE Details - CVE-2023-38333 | ManageEngine Applications Manager

## CVE-2023-38333

### Reflected XSS Vulnerability

| Vulnerability Details |  |
|---|---|
| Severity | **High** |
| CVE ID | CVE-2023-38333 |
| Affected software versions | Version 16530 and below |
| Fixed Version | Version 16367 to 16369<br>Version 16424 to 16429<br>Version 16512 to 16519<br>Version 16540 and above |
| Fixed On | 3 July 2023 |

### Details

Reflected XSS Vulnerability in a login url allows attacker to craft a malicious JavaScript payload. When clicking the crafted url that is shared by an attacker, malicious JavaScript gets executed in the victim browser.

### Impact

This vulnerability executes JavaScript in the victim's browser controlled by the attacker to carry out any of the actions that are applicable to the corresponding role of the victim in Applications Manager.

### Fix

Applications Manager version 16540 and above fixes this issue by using proper defence mechanisms against Cross-Site Scripting (XSS) vulnerability.

### Steps to update

Update your Applications Manager instance to the latest build using the [service pack](https://www.manageengine.com/products/applications_manager/service-packs.html).

### Source and Acknowledgements

Find out more about CVE-2023-38333 from [CVE Directory](https://www.cve.org/CVERecord?id=CVE-2023-38333) and [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-38333).

### Reported by:

Anonymous working with Trend Micro Zero Day Initiative.

### Need Help?

For clarification or corrections please contact our [support team](https://www.manageengine.com/products/applications_manager/support.html) or email us at [appmanager-support@manageengine.com](mailto:appmanager-support@manageengine.com).