CVE-2023-4769: Server-Side Request Forgery in ManageEngine Desktop Central

Published Nov 3, 2023

Updated

A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability could allow an authenticated attacker to launch targeted attacks, such as a cross-port attack, service enumeration and other attacks via HTTP requests.

Affected Software

1 affected component

ZohoCorp Manageengine Desktop Central=9.1.0

Remediation

Information

The vulnerability has been fixed in the latest version of Desktop Central.

Event History

Nov 3, 2023

CVE Published

via MITRE·10:55 AM

Data Sourced

via MITRE·10:55 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for this SSRF vulnerability in ManageEngine Desktop Central?

The vulnerability ID for this SSRF vulnerability in ManageEngine Desktop Central is CVE-2023-4769.

What is the affected software and version for this vulnerability?

The affected software and version for this vulnerability is ManageEngine Desktop Central version 9.1.0.

What is the severity of CVE-2023-4769?

The severity of CVE-2023-4769 is high with a severity value of 8.8.

How can an attacker exploit this vulnerability?

An attacker can exploit this vulnerability to launch targeted attacks, such as a cross-port attack, service enumeration, and other attacks via HTTP requests.

Is there a fix available for CVE-2023-4769?

Please refer to the vendor's security advisory or official documentation for information on patching or mitigating CVE-2023-4769.