Vulnerability record · CVE-2019-15083 · published 14 May 2020
CVE-2019-15083: Zohocorp manageengine servicedesk plus cross-site scripting vulnerability
Zohocorp · Manageengine Servicedesk Plus
Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.
Description
Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/157717/ManageEngine-Service-Desk-10.0-Cross-Site-Scripting.html | Third Party Advisory |
| https://www.exploit-db.com/exploits/48473 | Third Party Advisory |
| https://www.manageengine.com/products/service-desk/on-premises/readme.html#readme105 | Release NotesVendor Advisory |
| https://www.manageengine.com/products/service-desk/readme.html | Release NotesVendor Advisory |
| http://packetstormsecurity.com/files/157717/ManageEngine-Service-Desk-10.0-Cross-Site-Scripting.html | Third Party Advisory |
| https://www.exploit-db.com/exploits/48473 | Third Party Advisory |
| https://www.manageengine.com/products/service-desk/on-premises/readme.html#readme105 | Release NotesVendor Advisory |
| https://www.manageengine.com/products/service-desk/readme.html | Release NotesVendor Advisory |
Track CVE-2019-15083 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-15083), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
