PT-2019-8648 · Manageengine · Manageengine Servicedesk Plus

Filipe Reis + 1 · Published 2019-03-25 · Updated 2019-04-02 · CVE-2017-9362

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus versions prior to 9312

Description The issue concerns an XML injection at the add Configuration items CMDB API.

Recommendations For versions prior to 9312, update to version 9312 or later to resolve the issue.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-9362

Affected Products

Manageengine Servicedesk Plus

References · 3

• 🔥 https://labs.integrity.pt/advisories/cve-2017-9362 · Exploit
• https://osv.dev/vulnerability/CVE-2017-9362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9362 · Security Note