CVE-2023-23074

Deeper analysis

CVE-2023-23074 is a cross-site scripting vulnerability, tracked under CWE-79, that affects Zoho ManageEngine ServiceDesk Plus version 14. The flaw resides in the language component and can be triggered through the embedding of videos, producing a CVSS 3.1 base score of 6.1 with network attack vector, low complexity, no required privileges, and required user interaction.

An unauthenticated remote attacker can supply malicious video content that executes script in a victim's browser session. Successful exploitation yields limited confidentiality and integrity impacts with changed scope, allowing actions such as session token theft or unauthorized actions performed in the context of the authenticated user.

The vendor has published an advisory and corresponding bug-bounty report that describe the issue and link to remediation guidance. The associated EPSS score reached a peak of 0.8278 before receding to its current value of 0.7087.