ZDI-22-1490: ManageEngine ServiceDesk Plus MSP exportMickeyList Improper Input Validation Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine ServiceDesk Plus MSP. Authentication is required to exploit this vulnerability. The specific flaw exists within the exportMickeyList action. The issue results from the lack of proper validation of user-supplied data. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zoho ManageEngine ServiceDesk Plus MSP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-22-1490?
The severity of ZDI-22-1490 is critical due to its potential for privilege escalation.
How do I fix ZDI-22-1490?
To fix ZDI-22-1490, update your installation of ManageEngine ServiceDesk Plus MSP to the latest patched version.
Who is affected by ZDI-22-1490?
ZDI-22-1490 affects installations of ManageEngine ServiceDesk Plus MSP with unpatched vulnerabilities.
Is authentication required to exploit ZDI-22-1490?
Yes, authentication is required to exploit ZDI-22-1490.
What specific flaw does ZDI-22-1490 involve?
ZDI-22-1490 involves a flaw within the exportMickeyList action that allows for privilege escalation.
- agent/references
- agent/type
- agent/softwarecombine
- agent/title
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-22-1490
- alias/ZDI-CAN-18608
- alias/CVE-2022-40773
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/manageengine
- canonical/zoho manageengine servicedesk plus msp