CVE-2023-34197 — Incorrect Authorization in Manageengine Servicedesk Plus

CWE-863 — Incorrect Authorization3 documents3 sources

Severity

5.4MEDIUMNVD

EPSS

0.2%

top 59.35%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Servicedesk Plus Zohocorp Manageengine Servicedesk Plus MSP Zohocorp Manageengine Supportcenter Plus

Timeline

PublishedJul 7

Description

Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages3 packages

▶NVDzohocorp/manageengine_servicedesk_plus< 14.2+1

▶NVDzohocorp/manageengine_servicedesk_plus_msp< 14.2+1

▶NVDzohocorp/manageengine_supportcenter_plus< 14.2+1

🔴Vulnerability Details

CVEList

CVE-2023-34197: Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vu↗2023-07-07

▶

GHSA

GHSA-vgh6-qcg3-p3mf: Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vu↗2023-07-07

▶