PT-2022-25530 · Zoho · Manageengine Servicedesk Plus

Chudypb + 1 · Published 2022-11-21 · Updated 2025-04-28 · CVE-2022-40771

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions 13010 and prior

Description The issue is related to an XML External Entity attack, which leads to Information Disclosure. This attack can potentially expose sensitive information.

Recommendations For versions 13010 and prior, update to a version later than 13010 to resolve the issue. As a temporary workaround, consider restricting XML External Entity processing in the affected software until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-40771

ZDI-22-1612

Affected Products

Manageengine Servicedesk Plus

References · 9

• https://manageengine.com/products/service-desk/CVE-2022-40771.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40771 · Security Note
• https://manageengine.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-40771 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1612 · Security Note
• https://t.me/cibsecurity/53450 · Telegram Post
• https://t.me/cvenotify/38713 · Telegram Post
• https://t.me/cvenotify/38343 · Telegram Post
• https://t.me/cvenotify/120097 · Telegram Post