Headline
CVE-2023-34197: ManageEngine security advisory
Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications.
Privilege escalation vulnerability in the Release module
CVE ID : CVE-2023-34197
Product Name
Severity
Affected Version(s)
Fixed Version
Fixed On
ServiceDesk Plus
Low
14201 and below
14202
May 06, 2023
ServiceDesk Plus MSP
Low
14202 and below
14300
June 19, 2023
SupportCenter Plus
Low
14201 and below
14300
June 19, 2023
Details
A privilege escalation vulnerability in the Release module allowed unprivileged users to access the Reminders of a release ticket and modify it.
Impact
The vulnerability can be exploited by unprivileged users to view, create, edit or delete reminders for Releases.
Steps to upgrade
- Download the latest upgrade pack from the following links for the respective products:
- ServiceDesk Plus
- ServiceDesk Plus MSP
- SupportCenter Plus
- Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.
Acknowledgements
This vulnerability was reported by 4rth4s on our bug bounty portal.
If you have any questions or concerns, please contact product support at the email addresses below.
ServiceDesk Plus: [email protected]
ServiceDesk Plus MSP: [email protected]
SupportCenter Plus: [email protected]