CVE-2022-40770

published 2022-11-23

CVE-2022-40770: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.

Priority P2 61 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
zohocorp	manageengine_servicedesk_plus	< 13.0	13.0
zohocorp	manageengine_servicedesk_plus	—	—
zohocorp	manageengine_servicedesk_plus_msp	< 10.6	10.6
zohocorp	manageengine_servicedesk_plus_msp	—	—
zohocorp	manageengine_supportcenter_plus	< 11.0	11.0
zohocorp	manageengine_supportcenter_plus	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77