ZDI-CAN-18608: ManageEngine ServiceDesk Plus MSP exportMickeyList Improper Input Validation Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine ServiceDesk Plus MSP. Authentication is required to exploit this vulnerability. The specific flaw exists within the exportMickeyList action. The issue results from the lack of proper validation of user-supplied data. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zoho ManageEngine ServiceDesk Plus MSP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-CAN-18608?
The severity of ZDI-CAN-18608 is rated as high due to its potential to escalate privileges for authenticated users.
How do I fix ZDI-CAN-18608?
To fix ZDI-CAN-18608, update your ManageEngine ServiceDesk Plus MSP to the latest patched version provided by the vendor.
Who is affected by ZDI-CAN-18608?
ZDI-CAN-18608 affects installations of ManageEngine ServiceDesk Plus MSP that have not applied the necessary security updates.
What type of vulnerability is ZDI-CAN-18608?
ZDI-CAN-18608 is a privilege escalation vulnerability that requires authentication to exploit.
Is authentication required to exploit ZDI-CAN-18608?
Yes, authentication is required to exploit the ZDI-CAN-18608 vulnerability on affected systems.
- agent/references
- agent/softwarecombine
- agent/title
- agent/severity
- agent/type
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-22-1490
- alias/ZDI-CAN-18608
- alias/CVE-2022-40773
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/manageengine
- canonical/zoho manageengine servicedesk plus msp