Lucene search

PRIOn knowledge basePRION:CVE-2023-29443

HistoryApr 26, 2023 - 9:15 p.m.

Design/Logic Flaw

2023-04-2621:15:00

PRIOn knowledge base

www.prio-n.com

zoho manageengine

servicedesk plus

supportcenter plus

assetexplorer

xxe attacks

xml

reports integration api

cve-2021-37478

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

27.7%

JSON

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.

CPENameOperatorVersion
manageengine_assetexplorereq6.9 6980
manageengine_assetexplorereq6.9 6981
manageengine_assetexplorereq6.9 6982
manageengine_assetexplorereq6.9 6986
manageengine_assetexplorereq6.9 6987
manageengine_assetexplorereq6.9 6988
manageengine_assetexplorereq6.9 6983
manageengine_assetexplorereq6.9 6984
manageengine_assetexplorereq6.9 6985
manageengine_servicedesk_pluseq14.1 14101

Name	Operator	Version
manageengine_assetexplorer	eq	6.9 6980
manageengine_assetexplorer	eq	6.9 6981
manageengine_assetexplorer	eq	6.9 6982
manageengine_assetexplorer	eq	6.9 6986
manageengine_assetexplorer	eq	6.9 6987
manageengine_assetexplorer	eq	6.9 6988
manageengine_assetexplorer	eq	6.9 6983
manageengine_assetexplorer	eq	6.9 6984
manageengine_assetexplorer	eq	6.9 6985
manageengine_servicedesk_plus	eq	14.1 14101

Rows per page:

1-10 of 221

References

www.manageengine.com/products/service-desk/CVE-2023-29443.html

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

27.7%

JSON

Related for PRION:CVE-2023-29443