Headline
CVE-2023-26601: ManageEngine security advisory
Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS).
Denial of Service vulnerability in image upload
CVE ID : CVE-2023-26601
Product Name
Severity
Affected Version(s)
Fixed Version
Fixed On
ServiceDesk Plus
Medium
14103 and below
14104
Jan. 24, 2023
ServiceDesk Plus MSP
Medium
14000 and below
14001
Feb. 16, 2023
SupportCenter Plus
Medium
14000 and below
14001
Feb. 20, 2023
AssetExplorer
Medium
6987 and below
6988
Jan. 24, 2023
Details
This vulnerability allows an attacker to exploit the way an API method allocates memory by sending a small image file with a large size defined in the header, causing the application to crash or become unresponsive.
Impact
Users may not be able to access the application.
How was it resolved?
We have added limits for image pixel size and type validation for parameters.
Steps to upgrade
- Download the latest upgrade pack from the following links for the respective products:
- ServiceDesk Plus
- ServiceDesk Plus MSP
- SupportCenter Plus
- AssetExplorer
- Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.
Acknowledgements
This vulnerability was reported by Piotr Bazydlo (@chudyPB) of Trend Micro Zero Day Initiative.
If you have any questions or concerns, please contact product support at the email addresses below.
ServiceDesk Plus: [email protected]
ServiceDesk Plus MSP: [email protected]
SupportCenter Plus: [email protected]
AssetExplorer: [email protected]