CVE-2023-23074: Zoho ManageEngine ServiceDesk Plus stored XSS via embedded videos

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe CVSS score is only medium, but the very high EPSS percentile and the sensitive nature of an ITSM platform raise the practical risk.

What it is

Zoho ManageEngine ServiceDesk Plus 14 is affected by a cross-site scripting flaw reached through embedding videos in the language component. The CVSS vector shows scope change with low confidentiality and integrity impact, meaning script execution can affect resources beyond the vulnerable component. It matters because ServiceDesk Plus is a widely deployed IT service management platform, and script execution in that context can be used against authenticated staff.

Impact

An attacker can execute script in the browser context of a victim user, enabling session or credential theft and actions performed as that user. The scope change indicates the injected content can affect components beyond the vulnerable page itself.

Attack surface

Reached over the network with no privileges required, but user interaction is required per the CVSS vector, consistent with a victim viewing crafted content containing the embedded video. No authentication requirement is stated in the vector.

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is very high at 0.83581 (99.669th percentile), indicating elevated predicted exploitation likelihood, though the references carry only vendor advisory tags and no public exploit tag.

What to do

• Apply the vendor fix referenced in the ManageEngine advisory for CVE-2023-23074 and upgrade ServiceDesk Plus 14 to a patched build.
• Restrict or disable embedding of external video content in the language component until patched.
• Deploy output encoding and content sanitization for user-supplied content rendered in ServiceDesk Plus.
• Enforce a strict Content Security Policy to limit script execution from injected content.
• Remind users not to open untrusted links or embedded media in ServiceDesk Plus.

Detection

• Search web and proxy logs for requests to ServiceDesk Plus pages containing embedded video or language component parameters with script-like payloads.
• Monitor for anomalous script tags, event handlers or javascript: URIs in requests to ServiceDesk Plus endpoints.
• Alert on suspicious authenticated sessions or actions following viewing of embedded media content.
• Review ServiceDesk Plus application logs for unexpected changes to language or localization settings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.