Security advisory

Stored XSS vulnerability in the Release Details page

CVE ID : CVE-2023-23077

Product Name Severity Affected Version(s) Fixed Version Fixed On
ServiceDesk Plus Medium 14002 and below 14003 Oct. 22, 2022


A stored cross-site scripting (XSS) vulnerability allowed users to inject a malicious JavaScript in the Add Release page. The script gets executed when a user views the Release Details page.

We fixed the issue by encoding data during client rendering to prevent the JavaScript from being executed.


The vulnerability can be exploited by threat actors to perform further attacks.

Steps to upgrade

  1. Download the latest ServiceDesk Plus upgrade pack here.
  2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.


This vulnerability was reported by HMs on our bug bounty portal.

If you have any questions or concerns, please contact product support for further details at

Let's support faster, easier, and together