PT-2023-22266 · Zoho · Servicedesk Plus Msp+3

Minhgalaxy · CVE-2023-29443 · Publicado 2023-04-26 · Atualizado 2025-02-03

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 14105 ServiceDesk Plus MSP versions prior to 14200 SupportCenter Plus versions prior to 14200 AssetExplorer versions prior to 6989

Description The issue allows attackers with SDAdmin privileges to conduct XXE attacks by sending malformed XML from a crafted server to a "Reports integration API endpoint". This enables them to exploit the vulnerability.

Recommendations For Zoho ManageEngine ServiceDesk Plus versions prior to 14105, update to version 14105 or later. For ServiceDesk Plus MSP versions prior to 14200, update to version 14200 or later. For SupportCenter Plus versions prior to 14200, update to version 14200 or later. For AssetExplorer versions prior to 6989, update to version 6989 or later.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2023-29443

Produtos afetados

Assetexplorer

Servicedesk Plus Msp

Supportcenter Plus

Zoho Manageengine Servicedesk Plus

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-29443 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-29443 · Aviso do Fabricante
• https://t.me/cvenotify/109739 · Publicação no Telegram
• https://manageengine.com/products/service-desk/CVE-2023-29443.html · Aviso do Fabricante
• https://t.me/cibsecurity/62936 · Publicação no Telegram