PT-2023-22266 · Zoho · Servicedesk Plus Msp+3

Minhgalaxy · Published 2023-04-26 · Updated 2025-02-03 · CVE-2023-29443

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 14105 ServiceDesk Plus MSP versions prior to 14200 SupportCenter Plus versions prior to 14200 AssetExplorer versions prior to 6989

Description The issue allows attackers with SDAdmin privileges to conduct XXE attacks by sending malformed XML from a crafted server to a "Reports integration API endpoint". This enables them to exploit the vulnerability.

Recommendations For Zoho ManageEngine ServiceDesk Plus versions prior to 14105, update to version 14105 or later. For ServiceDesk Plus MSP versions prior to 14200, update to version 14200 or later. For SupportCenter Plus versions prior to 14200, update to version 14200 or later. For AssetExplorer versions prior to 6989, update to version 6989 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-29443

Affected Products

Assetexplorer

Servicedesk Plus Msp

Supportcenter Plus

Zoho Manageengine Servicedesk Plus

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-29443 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29443 · Vendor Advisory
• https://manageengine.com/products/service-desk/CVE-2023-29443.html · Vendor Advisory
• https://t.me/cvenotify/109739 · Telegram Post
• https://t.me/cibsecurity/62936 · Telegram Post