Main Vulnerability Database Vulnerabilities #VU69872

Permissions, Privileges, and Access Controls in Zoho ManageEngine SupportCenter Plus and Zoho ManageEngine ServiceDesk Plus MSP - CVE-2022-40772

Published: December 5, 2022 / Updated: December 5, 2022

Vulnerability identifier: #VU69872

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40772

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improper input validation within the generateSQLReport function, which leads to security restrictions bypass and privilege escalation.

Affected software

Zoho ManageEngine SupportCenter Plus
Zoho ManageEngine ServiceDesk Plus MSP

How to mitigate CVE-2022-40772

Install updates from vendor's website.

Zoho ManageEngine SupportCenter Plus - update to 11025
Zoho ManageEngine ServiceDesk Plus MSP - update to 10609

External References

Related Security Bulletins