Exchange Reporter Plus CVE-2025-5347

Exploitation requires an authenticated account with sufficient access to submit or configure data that is persisted and rendered by the reports module of ManageEngine Exchange Reporter Plus (PR:L), plus a second user viewing the poisoned report for the stored payload to fire (UI:R). Limiting factors: the attacker must already have valid low-privileged credentials to the application, the malicious content only executes when a victim loads the affected report, and only deployments on builds earlier than 5723 are affected - upgrading to 5723 remediates. Impact is confined to the victim's browser/session context (confidentiality and integrity Low, no availability impact).

This is a moderate, not urgent, priority. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a stored XSS that requires an already-authenticated low-privileged user to inject the payload (PR:L) and a victim to then view the affected report (UI:R); the scope change (S:C) reflects execution in the victim's browser context rather than a server compromise, and impacts are limited (C:L/I:L, A:N). The EPSS score of 0.45% (37th percentile) indicates low near-term exploitation probability, which is consistent with the absence of any CISA KEV listing and no public exploit code identified in the provided data. No signals conflict here - low EPSS, no KEV, and no POC all align with a 'patch in normal cycle' posture. The main real-world risk is an authenticated insider or a compromised low-privilege account escalating reach by targeting higher-privileged administrators who view reports; this is a session/UI-level threat, not remote unauthenticated code execution. Treat as a routine security update rather than an emergency.

An authenticated low-privileged user of ManageEngine Exchange Reporter Plus injects a malicious script into a field that is persisted and later rendered in the reports module. When an administrator or other user opens the affected report, the stored script executes in their browser session, potentially enabling session hijacking or actions performed as the victim. No public exploit code was identified at time of analysis.