Lucene search

[email protected]CVE-2022-40770

HistoryNov 23, 2022 - 3:15 a.m.

CVE-2022-40770

2022-11-2303:15:00

CWE-77

[email protected]

web.nvd.nist.gov

cve-2022-40770

zoho manageengine

servicedesk plus

authenticated

command injection

vulnerability

nvd

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

41.8%

JSON

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.

CPENameOperatorVersion
zohocorp:manageengine_servicedesk_pluszohocorp manageengine servicedesk pluseq13.0
zohocorp:manageengine_servicedesk_plus_mspzohocorp manageengine servicedesk plus mspeq10.6
zohocorp:manageengine_supportcenter_pluszohocorp manageengine supportcenter pluseq11.0

CPE	Name	Operator	Version
zohocorp:manageengine_servicedesk_plus	zohocorp manageengine servicedesk plus	eq	13.0
zohocorp:manageengine_servicedesk_plus_msp	zohocorp manageengine servicedesk plus msp	eq	10.6
zohocorp:manageengine_supportcenter_plus	zohocorp manageengine supportcenter plus	eq	11.0

References

manageengine.com

www.manageengine.com/products/service-desk/CVE-2022-40770.html

Social References

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

41.8%

JSON

Related for CVE-2022-40770

nessus3 prion1 zdi1