CVE-2023-28341

What it actually does

CVE-2023-28341 is a stored cross-site scripting vulnerability in Zoho ManageEngine Applications Manager through version 16340. An unauthenticated attacker can submit crafted input that is persisted and later rendered on the incorrect-login-details page without sufficient output encoding or sanitization. When a user views the affected page, attacker-controlled JavaScript executes in that user’s browser in the context of the Applications Manager web interface. Because the CVSS scope is changed, successful exploitation can cross the boundary between the vulnerable application and the victim’s browser session, enabling limited confidentiality and integrity impact such as session interaction, credential phishing, UI manipulation, or actions performed as the viewing user if session protections permit.

Why it matters to the business

A successful attack can turn the monitoring console’s login-error workflow into a delivery point for malicious browser code. This may expose user session data, trick administrators into entering credentials, alter what operators see in the interface, or support follow-on compromise of a system that often has visibility into critical infrastructure and application health. The EPSS score is very high, indicating a strong likelihood of exploitation activity compared with most vulnerabilities, so internet-exposed or broadly reachable ManageEngine Applications Manager deployments should be treated as high-priority even though the CVSS severity is moderate and the issue is not currently listed in CISA KEV.

How an attack unfolds

An attacker first reaches the Applications Manager web interface and targets the unauthenticated login path. They submit specially crafted input designed to be recorded as an incorrect login attempt or otherwise displayed on the incorrect-login-details page. Because the application stores and later renders that input unsafely, the payload remains available for future page views. When an administrator or operator reviews the incorrect login details page, the browser executes the injected JavaScript in the context of the Applications Manager site. The script can then attempt to steal accessible data, perform phishing or UI redressing, make same-origin requests as the victim, or stage additional actions depending on the victim’s privileges and browser/session hardening.

How to fix it

Upgrade Zoho ManageEngine Applications Manager to a vendor-fixed release newer than 16340. If an exact fixed version is not available in internal package metadata, use the latest supported build from Zoho/ManageEngine and verify vendor release notes for the stored XSS fix. As interim mitigations, restrict access to the Applications Manager web interface to trusted administrative networks or VPN, block direct internet exposure, enforce strong authentication and MFA for administrative users, clear suspicious stored login-error entries if supported by the product, and deploy web application firewall rules that block obvious script injection patterns in login-related parameters. Also ensure secure cookie attributes, Content Security Policy where supported, and session timeout controls are enabled to reduce browser-side impact.

How to confirm the fix worked

Confirm that the running Applications Manager build is later than 16340 or matches a vendor release that explicitly fixes this issue. From a non-production test environment or approved maintenance window, submit a harmless XSS test string to the login workflow and verify that it is either rejected, sanitized, or rendered as inert text on the incorrect-login-details page rather than executing. Review external attack surface scans to ensure the Applications Manager console is not publicly reachable unless explicitly required. Validate that administrative access is restricted by network controls and that application logs no longer show repeated unauthenticated requests containing HTML or JavaScript metacharacters in login-related fields.

Typical attack path

1. Identify a reachable Zoho ManageEngine Applications Manager instance, especially one exposed to the internet.
2. Send an unauthenticated login request containing a stored XSS payload in a field that is later shown on the incorrect-login-details page.
3. Wait for an administrator, operator, or other authenticated user to view the affected incorrect-login-details page.
4. Execute JavaScript in the victim’s browser under the Applications Manager origin.
5. Use the script to harvest accessible page data, present a phishing prompt, manipulate displayed content, or issue application requests as the victim where possible.
6. Leverage any obtained credentials, tokens, or privileged browser actions for follow-on access.

How to detect it

To determine whether exploitation already occurred, review Applications Manager access logs, audit logs, failed-login records, reverse proxy logs, WAF logs, and any centralized web server logs for unauthenticated requests to login-related endpoints containing HTML or JavaScript payloads. Focus on requests with parameters or usernames containing strings such as script tags, JavaScript URIs, event-handler attributes, iframe/object tags, encoded angle brackets, or common XSS proof-of-concept functions. Correlate suspected injection times with administrator access to the incorrect-login-details page; a stored XSS attempt is more concerning if a privileged user later viewed the affected page. On endpoints used by administrators, review browser history, EDR telemetry, and proxy logs around the time of page views for unexpected outbound requests to unfamiliar domains, data exfiltration via query strings, or credential-phishing pages opened from the Applications Manager origin. Also review Applications Manager audit trails after suspected page views for unusual administrative actions, newly created users, configuration changes, credential store access, or changes to monitored assets. No public, unique exploit artifact is guaranteed for this vulnerability, so detections should emphasize script-like content in login fields and subsequent privileged activity anomalies.

• <script
• </script>
• %3Cscript
• %3C%2Fscript%3E
• javascript:
• onerror=
• onload=
• onclick=
• onmouseover=
• alert(
• prompt(
• confirm(
• document.cookie
• localStorage
• sessionStorage
• eval(
• String.fromCharCode
• <iframe
• %3Ciframe
• <img
• %3Cimg
• srcdoc=
• base64,
• incorrect login
• incorrect login details

What your security team should do

• Prioritize upgrade of all Zoho ManageEngine Applications Manager deployments through 16340 to the latest supported fixed build, especially internet-facing instances.
• Restrict access to the Applications Manager web interface to trusted administrative networks, VPN, or zero-trust access controls.
• Search historical logs for unauthenticated login attempts containing script tags, event handlers, encoded JavaScript, or HTML injection characters.
• Have administrators who viewed incorrect-login-details pages during suspected exposure windows reset passwords if credential phishing or session theft is suspected.
• Review browser/session security controls, including MFA, secure cookies, session timeout, and phishing-resistant authentication for administrative users.
• Add SIEM detections for script-like payloads in failed-login or incorrect-login-detail logs.
• If suspicious payloads are found, perform incident response review of administrator activity after the page view, including unusual configuration changes, new users, or unexpected outbound connections from browsers or management workstations.