Lucene search

[email protected]NVD:CVE-2023-29443

HistoryApr 26, 2023 - 9:15 p.m.

CVE-2023-29443

2023-04-2621:15:08

CWE-611

[email protected]

web.nvd.nist.gov

zoho

manageengine

servicedesk plus

supportcenter plus

assetexplorer

xxe

vulnerability

xml

reports integration api

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.2%

JSON

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.

Affected configurations

NVD

Node

zohocorpmanageengine_assetexplorerMatch6.96980

zohocorpmanageengine_assetexplorerMatch6.96981

zohocorpmanageengine_assetexplorerMatch6.96982

zohocorpmanageengine_assetexplorerMatch6.96983

zohocorpmanageengine_assetexplorerMatch6.96984

zohocorpmanageengine_assetexplorerMatch6.96985

zohocorpmanageengine_assetexplorerMatch6.96986

zohocorpmanageengine_assetexplorerMatch6.96987

zohocorpmanageengine_assetexplorerMatch6.96988

zohocorpmanageengine_servicedesk_plusRange<14.1

zohocorpmanageengine_servicedesk_plusMatch14.1-

zohocorpmanageengine_servicedesk_plusMatch14.114100

zohocorpmanageengine_servicedesk_plusMatch14.114101

zohocorpmanageengine_servicedesk_plusMatch14.114102

zohocorpmanageengine_servicedesk_plusMatch14.114103

zohocorpmanageengine_servicedesk_plusMatch14.114104

zohocorpmanageengine_servicedesk_plus_mspRange<14.0

zohocorpmanageengine_servicedesk_plus_mspMatch14.014000

zohocorpmanageengine_servicedesk_plus_mspMatch14.014001

zohocorpmanageengine_supportcenter_plusRange<14.0

zohocorpmanageengine_supportcenter_plusMatch14.014000

zohocorpmanageengine_supportcenter_plusMatch14.014001

References

www.manageengine.com/products/service-desk/CVE-2023-29443.html

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.2%

JSON

Related for NVD:CVE-2023-29443

cve1 cvelist1 prion1 nessus4