CVE-2023-34197
First published: Fri Jul 07 2023(Updated: )
Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp Manageengine Servicedesk Plus | <14.2 | |
| Zohocorp Manageengine Servicedesk Plus | =14.2-14200 | |
| Zohocorp Manageengine Servicedesk Plus | =14.2-14201 | |
| Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | <14.2 | |
| Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | =14.2-14200 | |
| Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | =14.2-14201 | |
| Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | =14.2-14202 | |
| Zohocorp Manageengine Supportcenter Plus | <14.2 | |
| Zohocorp Manageengine Supportcenter Plus | =14.2-14200 | |
| Zohocorp Manageengine Supportcenter Plus | =14.2-14201 | |
| Zohocorp Manageengine Servicedesk Plus Msp | <14.2 | |
| Zohocorp Manageengine Servicedesk Plus Msp | =14.2-14200 | |
| Zohocorp Manageengine Servicedesk Plus Msp | =14.2-14201 | |
| Zohocorp Manageengine Servicedesk Plus Msp | =14.2-14202 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-34197?
CVE-2023-34197 is a vulnerability in Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus that allows unprivileged users to access and modify release tickets.
How severe is CVE-2023-34197?
CVE-2023-34197 has a severity rating of 5.4, which is considered medium.
Which versions of Zoho ManageEngine ServiceDesk Plus are affected by CVE-2023-34197?
CVE-2023-34197 affects Zoho ManageEngine ServiceDesk Plus versions up to and including 14.2.
How can unprivileged users exploit CVE-2023-34197?
Unprivileged users can exploit CVE-2023-34197 to access the Reminders of a release ticket and make modifications.
Is there a fix available for CVE-2023-34197?
Yes, a fix is available for CVE-2023-34197. It is recommended to update Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus to version 14.3 or higher.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- vendor/zohocorp
- canonical/zohocorp manageengine servicedesk plus
- version/zohocorp manageengine servicedesk plus/14.2-14200
- version/zohocorp manageengine servicedesk plus/14.2-14201
- canonical/zoho manageengine servicedesk plus (sdp) / supportcenter plus
- version/zoho manageengine servicedesk plus (sdp) / supportcenter plus/14.2-14200
- version/zoho manageengine servicedesk plus (sdp) / supportcenter plus/14.2-14201
- version/zoho manageengine servicedesk plus (sdp) / supportcenter plus/14.2-14202
- canonical/zohocorp manageengine supportcenter plus
- version/zohocorp manageengine supportcenter plus/14.2-14200
- version/zohocorp manageengine supportcenter plus/14.2-14201
- canonical/zohocorp manageengine servicedesk plus msp
- version/zohocorp manageengine servicedesk plus msp/14.2-14200
- version/zohocorp manageengine servicedesk plus msp/14.2-14201
- version/zohocorp manageengine servicedesk plus msp/14.2-14202