Information Disclosure Vulnerability in Zoho ManageEngine SupportCenter Plus
CVE-2022-42903

3.3LOW

Key Information:

Vendor

Zohocorp
Status
Manageengine Supportcenter Plus
Vendor
CVE Published:
17 November 2022

What is CVE-2022-42903?

An information disclosure vulnerability exists in Zoho ManageEngine SupportCenter Plus that permits low-privileged users to access sensitive details, specifically the list of organization users. This flaw can potentially expose user data that should remain confidential, underscoring the importance of restricting access rights within the application. Organizations using affected versions should consider implementing immediate security measures to mitigate the risk.

References

https://www.manageengine.com/products/support-center/cve-...

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.