ManageEngine Exchange Reporter Plus Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in ManageEngine Exchange Reporter Plus, affecting versions prior to 5802. The issue resides within the Distribution Lists report, where an authenticated attacker with Exchange administrative privileges could inject and execute malicious scripts. This exploitation would allow the attacker to perform actions within Exchange Reporter Plus based on the privileges of the user accessing the compromised report.

Impact

Exploitation of this vulnerability could enable an authenticated attacker to inject and execute malicious scripts, potentially leading to unauthorized actions within Exchange Reporter Plus, based on the privileges of the user who accesses the affected report.

Remediation

Users can update to Exchange Reporter Plus version 5802 or later. Instructions for downloading the latest version are available on the ManageEngine Exchange Reporter Plus website.