Main Vulnerability Database Vulnerabilities #VU69880

Permissions, Privileges, and Access Controls in Zoho ManageEngine SupportCenter Plus and Zoho ManageEngine ServiceDesk Plus MSP - CVE-2022-40773

Published: December 5, 2022

Vulnerability identifier: #VU69880

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40773

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improper input validation within the exportMickeyList action, which leads to security restrictions bypass and privilege escalation.

Affected software

Zoho ManageEngine SupportCenter Plus
Zoho ManageEngine ServiceDesk Plus MSP

How to mitigate CVE-2022-40773

Install updates from vendor's website.

Zoho ManageEngine SupportCenter Plus - update to 11025
Zoho ManageEngine ServiceDesk Plus MSP - update to 10609

External References

Related Security Bulletins