Lucene search

[email protected]CVE-2022-40771

HistoryNov 23, 2022 - 6:15 p.m.

CVE-2022-40771

2022-11-2318:15:00

CWE-611

[email protected]

web.nvd.nist.gov

zoho

manageengine

servicedesk plus

cve-2022-40771

vulnerability

xml external entity attack

information disclosure

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

18.9%

JSON

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.

CPENameOperatorVersion
zohocorp:manageengine_servicedesk_pluszohocorp manageengine servicedesk pluslt14.0
zohocorp:manageengine_servicedesk_plus_mspzohocorp manageengine servicedesk plus msplt13.0
zohocorp:manageengine_supportcenter_pluszohocorp manageengine supportcenter pluseq11.0
zohocorp:manageengine_assetexplorerzohocorp manageengine assetexplorereq6.9

CPE	Name	Operator	Version
zohocorp:manageengine_servicedesk_plus	zohocorp manageengine servicedesk plus	lt	14.0
zohocorp:manageengine_servicedesk_plus_msp	zohocorp manageengine servicedesk plus msp	lt	13.0
zohocorp:manageengine_supportcenter_plus	zohocorp manageengine supportcenter plus	eq	11.0
zohocorp:manageengine_assetexplorer	zohocorp manageengine assetexplorer	eq	6.9

References

manageengine.com

www.manageengine.com/products/service-desk/CVE-2022-40771.html

Social References

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

18.9%

JSON

Related for CVE-2022-40771

nessus4 prion1 zdi1