CVE-2024-27314

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27314
Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users.
CVSS

No CVSS.

References
Link Resource
https://www.manageengine.com/products/service-desk/cve-2024-27314.html Vendor Advisory
https://www.manageengine.com/products/service-desk/cve-2024-27314.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14700:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14710:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14720:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.7:14700:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.7:14710:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.7:14710:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.7:14700:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:*
History

17 Jun 2025, 20:18

Type Values Removed Values Added
CPE cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.7:14710:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.7:14700:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.7:14710:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14710:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.7:14700:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14720:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.7:14700:*:*:*:*:*:*
First Time Zohocorp
Zohocorp manageengine Servicedesk Plus
Zohocorp manageengine Supportcenter Plus
Zohocorp manageengine Servicedesk Plus Msp
References () https://www.manageengine.com/products/service-desk/cve-2024-27314.html - () https://www.manageengine.com/products/service-desk/cve-2024-27314.html - Vendor Advisory

30 May 2024, 06:15

Type Values Removed Values Added
Summary Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14730 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users. Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users.

27 May 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-27 07:15

Updated : 2025-06-17 20:18

NVD link : CVE-2024-27314

Mitre link : CVE-2024-27314

JSON object : View

Products Affected

zohocorp

  • manageengine_servicedesk_plus
  • manageengine_supportcenter_plus
  • manageengine_servicedesk_plus_msp
CWE

No CWE.