保存済み XSS 脆弱性

Successful exploitation of CVE-2026-28703 allows an attacker to inject arbitrary JavaScript code into the 'Mails Exchanged Between Users' report within ManageEngine Exchange Reporter Plus. When a user views this report, the injected script executes in their browser context. This can lead to various malicious outcomes, including session hijacking, credential theft (if the user is logged into other applications), and redirection to phishing sites. The attacker could potentially gain control of the user's account and access sensitive email data. The blast radius extends to all users who view the compromised report.

Organizations using ManageEngine Exchange Reporter Plus versions 0–5802 are at risk, particularly those with a large number of users accessing the 'Mails Exchanged Between Users' report. Shared hosting environments where multiple tenants share the same Exchange Reporter Plus instance are also at increased risk, as a compromised tenant could potentially impact other tenants.

• web: Use curl or wget to check the 'Mails Exchanged Between Users' report endpoint for unusual JavaScript code. Inspect response headers for unexpected content-security-policy directives.

curl -s 'http://<exchange_reporter_plus_url>/reports/mails_exchanged_between_users.aspx' | grep -i '<script>' 

• generic web: Monitor access and error logs for requests containing suspicious JavaScript payloads targeting the report endpoint. • generic web: Review response headers for signs of XSS filtering bypass attempts.

1. 2026-04-03Disclosure

   disclosure

1. 予約済み2026-03-13
2. 公開日2026-04-03
3. 更新日2026-04-04
4. EPSS 更新日2026-04-10

The primary mitigation for CVE-2026-28703 is to upgrade ManageEngine Exchange Reporter Plus to version 5802 or later, which contains the fix. If immediate upgrading is not possible, consider restricting access to the 'Mails Exchanged Between Users' report to only authorized personnel. Implement strict input validation and output encoding on all user-supplied data within the report generation process as a temporary workaround. Monitor web application firewalls (WAFs) for suspicious JavaScript injection attempts targeting the report endpoint.