PT-2022-25530 · Zoho · Manageengine Servicedesk Plus
CVSS v3.1
4.9
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior
Description
The issue is related to an XML External Entity attack, which leads to Information Disclosure. This attack can potentially expose sensitive information.
Recommendations
For versions 13010 and prior, update to a version later than 13010 to resolve the issue. As a temporary workaround, consider restricting XML External Entity processing in the affected software until a patch is available.
Fix
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Manageengine Servicedesk Plus