CVE-2025-7632

Q: What is the severity of CVE-2025-7632?

CVE-2025-7632 has a CVSS score of 7.3 (HIGH). Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below contain a stored cross-site scripting (XSS) vulnerability in the Public Folders report feature. This allows attackers to inject malicious scripts that execute when users view the affected reports. Organizations using vulnerable versions of this software are at risk.

7.3 HIGH

Cross-Site Scripting

📋 TL;DR

Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below contain a stored cross-site scripting (XSS) vulnerability in the Public Folders report feature. This allows attackers to inject malicious scripts that execute when users view the affected reports. Organizations using vulnerable versions of this software are at risk.

💻 Affected Systems

Products:

Zohocorp ManageEngine Exchange Reporter Plus

Versions: 5723 and below

Operating Systems: Windows, Linux

Default Config Vulnerable: ⚠️ Yes

Notes: All installations with Public Folders report functionality enabled are vulnerable. The vulnerability exists in the web interface component.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, hijack user sessions, redirect users to malicious sites, or perform actions on behalf of authenticated users, potentially leading to full system compromise.

🟠

Likely Case

Attackers with access to the application could inject malicious scripts that steal session cookies or credentials from other users viewing the Public Folders reports.

🟢

If Mitigated

With proper input validation and output encoding, malicious scripts would be rendered harmless as text rather than executable code.

🌐 Internet-Facing: HIGH

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires the attacker to have access to inject malicious content into the Public Folders report, which typically requires some level of access to the application.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5724 or later

Vendor Advisory: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7632.html

Restart Required: Yes

Instructions:

1. Download the latest version (5724+) from the ManageEngine website
2. Backup your current installation and configuration
3. Run the installer to upgrade to the patched version
4. Restart the Exchange Reporter Plus service

🔧 Temporary Workarounds

Disable Public Folders Report

all

Temporarily disable the vulnerable Public Folders report feature until patching can be completed

Implement Web Application Firewall

all

Deploy a WAF with XSS protection rules to block malicious script injection attempts

🧯 If You Can't Patch

Implement strict input validation and output encoding for all user-supplied content in the Public Folders report
Restrict access to the Exchange Reporter Plus interface to trusted users only using network segmentation and access controls

🔍 How to Verify

Check if Vulnerable:

Check the installed version of ManageEngine Exchange Reporter Plus. If version is 5723 or below, the system is vulnerable.

Check Version:

Check the version in the web interface under Help > About, or examine the installation directory for version information

Verify Fix Applied:

Verify the installed version is 5724 or higher and test the Public Folders report functionality with safe test payloads.

📡 Detection & Monitoring

Log Indicators:

Unusual script tags or JavaScript code in Public Folders report entries
Multiple failed attempts to access or modify report content
Unexpected changes to report configurations

Network Indicators:

HTTP requests containing suspicious script payloads to the Public Folders report endpoints
Outbound connections to unexpected domains from the Exchange Reporter Plus server

SIEM Query:

source="ExchangeReporterPlus" AND (uri="*PublicFolders*" OR uri="*report*" OR uri="*folder*") AND (content="<script>" OR content="javascript:" OR content="onload=" OR content="onerror=")

📊 Metadata

CVE ID: CVE-2025-7632

CVSS v3 Score: 7.3 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE: CWE-79

EPSS Score: 0.04% exploit probability (11.9th percentile)

Published: November 11, 2025

Last Updated: November 21, 2025

🔗 References

https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7632.html Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

Manageengine Exchange Reporter Plus by Zohocorp

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable Public Folders Report

Implement Web Application Firewall

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities