CVE-2023-22964

CWE-287 — Improper Authentication3 documents3 sources

Severity

9.1CRITICAL

EPSS

1.0%

top 22.88%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Servicedesk Plus MSP

Timeline

PublishedJan 20

Description

Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages1 packages

▶NVDzohocorp/manageengine_servicedesk_plus_msp10.6, 13.0+1

🔴Vulnerability Details

GHSA

GHSA-p357-h73m-92rg: Zoho ManageEngine ServiceDesk Plus MSP through 13003 is vulnerable to authentication bypass due to the unsafe LDAP configuration (issue 1 of 2)↗2023-01-20

▶

CVEList

CVE-2023-22964: Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled↗2023-01-20

▶