Security advisory

Stored XSS vulnerability in the Advanced Portal product tour

CVE ID : CVE-2023-23074

Product Name	Severity	Affected Version(s)	Fixed Version	Fixed On
ServiceDesk Plus	Low	14103 and below	14104	Jan. 24, 2023

Details

A stored cross-site scripting (XSS) vulnerability allowed users with the Admin role to inject a malicious JavaScript under the Advanced Portal configurations. The script is executed when a user views the product tour or the product tour preview.

We fixed the issue by encoding data during client rendering to prevent the JavaScript from being executed.

Impact

The vulnerability can be exploited by threat actors to perform further attacks.

Steps to upgrade

1. Download the latest ServiceDesk Plus upgrade pack here.
2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above link.

Acknowledgements

This vulnerability was reported by HMs on our bug bounty portal.

If you have any questions or concerns, please contact product support for further details at support@servicedeskplus.com