CVE-2023-29443

2023-04-2600:00:00

mitre

www.cve.org

zoho

manageengine

xxe

vulnerability

servicedesk plus

assetexplorer

reports integration api

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.2%

JSON

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.

References

www.manageengine.com/products/service-desk/CVE-2023-29443.html