ManageEngine Exchange Reporter Plus Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in ManageEngine Exchange Reporter Plus, affecting versions through 5721. The issue arises in the Instant Search feature within the Content Search module, allowing attackers to inject malicious scripts that could be executed within the application.

Impact

Exploitation of this vulnerability could enable attackers to execute injected scripts, potentially leading to unauthorized access or actions within the application.

Remediation

Users are advised to update Exchange Reporter Plus to version 5722 or later. The latest service pack can be downloaded from the ManageEngine website. For assistance with the update, contact ManageEngine product support.