CVE-2021-46065

What it actually does

This vulnerability is a stored cross-site scripting issue in the Secondary Email field of Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306. An authenticated user with sufficient privileges can save JavaScript or HTML content into that field. When another user views the affected record or page, the application renders the injected content in the browser instead of safely encoding it. Because the script executes in the victim user's authenticated ServiceDesk Plus session, it may read page content, perform actions available to the victim, alter displayed data, or exfiltrate session-adjacent information that is accessible to client-side JavaScript. The CVSS vector indicates network exploitability, low attack complexity, required high privileges for injection, and required user interaction by a victim who views the affected page.

Why it matters to the business

Successful exploitation can allow a malicious insider or an attacker who has already obtained a privileged ServiceDesk Plus account to target administrators or help desk staff through the application interface. The likely consequences include unauthorized ticket or user changes performed through the victim's browser, theft of sensitive help desk data visible in the UI, credential or token harvesting where browser protections allow it, and loss of trust in the service management platform. Although this is not a direct unauthenticated remote code execution flaw, the high EPSS score and public exploit availability increase urgency because attackers may incorporate it into post-compromise workflows against exposed or internet-accessible ServiceDesk Plus deployments.

How an attack unfolds

An attacker first obtains access to ServiceDesk Plus using an account with the privileges needed to edit a user/contact profile or another workflow exposing the Secondary Email field. The attacker enters a crafted payload such as a script tag, event-handler attribute, or encoded JavaScript into the Secondary Email value and saves the record. Because the vulnerable build does not properly sanitize or output-encode that value, the payload is stored by the application. The attacker then waits for, or lures, a more valuable user such as an administrator or technician to view the affected page. When the victim opens the page, the browser executes the attacker's JavaScript in the ServiceDesk Plus origin. The script may attempt to read visible ticket or account data, issue application requests as the victim, modify settings, create persistence through additional stored payloads, or send collected data to an attacker-controlled endpoint.

How to fix it

Upgrade Zoho ManageEngine ServiceDesk Plus to a vendor-supported build that contains the fix for this issue. Because no exact fixed version was provided in the input, consult the ManageEngine ServiceDesk Plus release notes and security advisories, and prioritize moving beyond version 11.3 Build 11306 to the latest available build. If immediate upgrade is not possible, restrict access to the ServiceDesk Plus administrative and user-management interfaces, limit who can edit secondary email/contact fields, require VPN or trusted-network access for the application, and monitor or temporarily sanitize existing Secondary Email values containing HTML, JavaScript, URL-encoded script content, or suspicious event-handler attributes. Apply defense-in-depth controls such as strong session settings, multi-factor authentication, least-privilege roles, and a restrictive Content Security Policy where supported, but do not treat these as substitutes for patching.

How to confirm the fix worked

Confirm that all ServiceDesk Plus instances are running a fixed or current vendor-supported build rather than 11.3 Build 11306. Validate through the product's About page, administrative build information, package inventory, or authenticated version checks. Review a sample of user/contact records and verify that input containing characters such as less-than, greater-than, quotes, script tags, and event-handler attributes is rejected, sanitized, or safely rendered as text rather than executed. In a non-production test environment only, attempt to save a benign XSS proof string such as an inert alert payload in the Secondary Email field and verify that it does not execute when the affected page is viewed. Also verify that any compensating access controls remain in place for internet-exposed deployments until patching is complete.

Typical attack path

1. Gain authenticated access to Zoho ManageEngine ServiceDesk Plus with privileges sufficient to modify the Secondary Email field.
2. Insert a crafted JavaScript or HTML payload into the Secondary Email field and save the record.
3. Trigger rendering of the affected user/contact/profile page by a technician, administrator, or other targeted user.
4. Execute JavaScript in the victim's authenticated browser session under the ServiceDesk Plus web origin.
5. Use the victim's permissions to read visible data, perform unauthorized actions, alter application records, or exfiltrate accessible information.
6. Optionally modify additional records or settings to maintain a client-side foothold or broaden exposure.

How to detect it

To determine whether this was already exploited, review ServiceDesk Plus application audit logs for creation or modification of user/contact/profile records involving the Secondary Email field, especially by unusual accounts or at unusual times. Correlate those events with web access logs showing subsequent page views by administrators or technicians. Search HTTP request logs, reverse proxy logs, WAF logs, and application logs for common XSS payload markers in parameters associated with user, contact, requester, or profile updates. Look for payloads using script tags, SVG/onload handlers, image onerror handlers, JavaScript URLs, iframe tags, encoded angle brackets, document.cookie access, fetch/XMLHttpRequest calls, or references to unfamiliar external domains. On endpoints used by ServiceDesk Plus administrators and technicians, investigate browser history, DNS logs, proxy logs, and EDR telemetry for outbound connections to suspicious domains immediately after viewing ServiceDesk Plus pages. If full packet capture, WAF request bodies, or application database backups are available, search for stored malicious HTML/JavaScript in profile and contact data. Treat any discovery of stored executable markup in the Secondary Email field as a potential compromise requiring removal of the payload, identification of users who viewed it, session invalidation, and credential review.

• <script
• </script>
• javascript:
• onerror=
• onload=
• onclick=
• onmouseover=
• <img
• <svg
• <iframe
• document.cookie
• document.domain
• localStorage
• sessionStorage
• XMLHttpRequest
• fetch(
• new Image(
• eval(
• atob(
• String.fromCharCode
• %3Cscript
• %3C%2Fscript%3E
• %3Cimg
• %3Csvg
• %3Ciframe
• &#x3c;script
• &lt;script
• Secondary Email

What your security team should do

• Prioritize upgrade or migration away from ServiceDesk Plus 11.3 Build 11306 because exploit code is publicly available and the EPSS score indicates elevated likelihood of exploitation.
• Inventory all internet-facing and internally exposed ServiceDesk Plus deployments and confirm their exact build numbers.
• Restrict access to ServiceDesk Plus administration and profile-management functions to trusted networks and least-privilege roles until remediation is complete.
• Search existing Secondary Email values and related profile/contact fields for HTML, JavaScript, encoded payloads, and suspicious external URLs.
• Review web access logs and application audit logs for edits to secondary email/contact fields followed by administrator or technician page views.
• Investigate any suspicious outbound browser-initiated connections from ServiceDesk Plus user workstations to unfamiliar domains shortly after viewing user/contact records.
• Ensure MFA is enforced for ServiceDesk Plus users and rotate credentials or sessions if evidence suggests script-based credential or token theft.
• Add SIEM detections for common XSS payload patterns submitted to ServiceDesk Plus endpoints.