Privilege Escalation Vulnerability in Zoho ManageEngine ServiceDesk Plus MSP and SupportCenter Plus
CVE-2022-40773

8.8HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Supportcenter Plus
Manageengine Servicedesk Plus Msp
Vendor
CVE Published:
12 November 2022

What is CVE-2022-40773?

Zoho ManageEngine ServiceDesk Plus MSP before version 10609 and SupportCenter Plus before version 11025 exhibit a privilege escalation vulnerability, allowing users to extract sensitive information during the exportMickeyList operation. This occurs while exporting requests from the list view, potentially exposing critical data to unauthorized users.

References

https://www.manageengine.com/products/service-desk-msp/cv...
https://www.zerodayinitiative.com/advisories/ZDI-22-1490/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.