Improper Authentication in Zoho ManageEngine ServiceDesk Plus MSP - #VU72419
Published: February 20, 2023
Vulnerability identifier: #VU72419
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass 2FA authentication process.
The vulnerability exists due to an error in the Two-Factor Authentication login page. A remote attacker with knowledge of victim's credentials can bypass 2FA authentication process and gain unauthorized access to the application.
Affected software
Zoho ManageEngine ServiceDesk Plus MSP
Zoho ManageEngine SupportCenter Plus
Zoho ManageEngine SupportCenter Plus
Remediation
Install updates from vendor's website.
Zoho ManageEngine ServiceDesk Plus MSP - update to 14001
Zoho ManageEngine SupportCenter Plus - update to 14001
Zoho ManageEngine SupportCenter Plus - update to 14001