Security advisory

XSS vulnerability in the asset details page

CVE ID : CVE-2023-23078

Product Name Severity Affected Version(s) Fixed Version Fixed On
ServiceDesk Plus Medium 14102 and below 14103 Dec. 23, 2022
ServiceDesk Plus MSP Medium 13004 and below 14000 Jan. 23, 2023
AssetExplorer Medium 6986 and below 6987 Dec. 23, 2022

Details

A stored cross-site scripting (XSS) vulnerability allowed users to inject a malicious JavaScript in the asset details page. The script is executed when a user views the asset page.

We fixed the issue by encoding data during client rendering to prevent the JavaScript from being executed.

Impact

The vulnerability can be exploited by threat actors to perform further attacks.

Steps to upgrade

  1. Download the latest upgrade pack from the following links for the respective products:
  2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements

This vulnerability was reported by HMs on our bug bounty portal.

If you have any questions or concerns, please contact product support for further details at the below-mentioned email addresses.

ServiceDesk Plus: support@servicedeskplus.com

ServiceDesk Plus MSP: support@servicedeskplusmsp.com

AssetExplorer: assetexplorer-support@manageengine.com

Let's support faster, easier, and together