CVE-2020-6843

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Zoho ManageEngine ServiceDesk Plus version 11.0 Build 11007 [3]. The issue allows an attacker to inject arbitrary JavaScript code into the application, which is then executed in the context of the victim's browser. The vulnerability was addressed in version 11.0 Build 11010 (SD-83959) [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious payload and injecting it into an input field or parameter that is not properly sanitized. The victim must then interact with the crafted content, such as viewing a page or clicking a link, for the script to execute. No authentication is required if the vulnerable endpoint is publicly accessible, but the exact attack vector is not detailed in the available references.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, data theft, defacement, or other malicious actions within the context of the ServiceDesk Plus application. The attacker gains the same privileges as the victim user.

Mitigation

The vulnerability is fixed in Zoho ManageEngine ServiceDesk Plus version 11.0 Build 11010, released on an unspecified date [1]. Users should upgrade to this version or later. No workarounds are documented. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.