ManageEngine Exchange Reporter Plus Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in ManageEngine Exchange Reporter Plus, affecting versions prior to 5802. The issue resides in the Equipment Mailbox Details report within the Reports module. This vulnerability allows authenticated attackers with Exchange administrative privileges to inject and execute malicious scripts. Exploitation could enable these attackers to perform actions within Exchange Reporter Plus based on the privileges of the user who accesses the affected report.

Impact

Successful exploitation allows for the injection and execution of malicious scripts, potentially leading to unauthorized actions within Exchange Reporter Plus, based on the privileges of the user accessing the compromised report.

Remediation

Users can update to Exchange Reporter Plus version 5802 or later. Instructions for downloading the latest version are available on the ManageEngine Exchange Reporter Plus website.