Lucene search

MitreCVE-2023-34197

HistoryJul 07, 2023 - 1:15 p.m.

CVE-2023-34197

2023-07-0713:15:09

mitre

web.nvd.nist.gov

zoho

manageengine

servicedesk plus

privilege escalation

vulnerability

nvd

cve-2023-34197

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.6

Confidence

High

EPSS

0.003

Percentile

66.2%

JSON

Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications.

Affected configurations

Nvd

Node

zohocorpmanageengine_servicedesk_plusRange<14.2

zohocorpmanageengine_servicedesk_plusMatch14.214200

zohocorpmanageengine_servicedesk_plusMatch14.214201

Node

zohocorpmanageengine_servicedesk_plus_mspRange<14.2

zohocorpmanageengine_servicedesk_plus_mspMatch14.214200

zohocorpmanageengine_servicedesk_plus_mspMatch14.214201

zohocorpmanageengine_servicedesk_plus_mspMatch14.214202

Node

zohocorpmanageengine_supportcenter_plusRange<14.2

zohocorpmanageengine_supportcenter_plusMatch14.214200

zohocorpmanageengine_supportcenter_plusMatch14.214201

VendorProductVersionCPE
zohocorpmanageengine_servicedesk_plus*cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus14.2cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.2:14200:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus14.2cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.2:14201:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus_msp*cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus_msp14.2cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14200:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus_msp14.2cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14201:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus_msp14.2cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14202:*:*:*:*:*:*
zohocorpmanageengine_supportcenter_plus*cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:*
zohocorpmanageengine_supportcenter_plus14.2cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.2:14200:*:*:*:*:*:*
zohocorpmanageengine_supportcenter_plus14.2cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.2:14201:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_servicedesk_plus	*	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus::::::::
zohocorp	manageengine_servicedesk_plus	14.2	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.2:14200::::::
zohocorp	manageengine_servicedesk_plus	14.2	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.2:14201::::::
zohocorp	manageengine_servicedesk_plus_msp	*	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp::::::::
zohocorp	manageengine_servicedesk_plus_msp	14.2	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14200::::::
zohocorp	manageengine_servicedesk_plus_msp	14.2	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14201::::::
zohocorp	manageengine_servicedesk_plus_msp	14.2	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14202::::::
zohocorp	manageengine_supportcenter_plus	*	cpe:2.3:a:zohocorp:manageengine_supportcenter_plus::::::::
zohocorp	manageengine_supportcenter_plus	14.2	cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.2:14200::::::
zohocorp	manageengine_supportcenter_plus	14.2	cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.2:14201::::::

References

www.manageengine.com/products/service-desk/CVE-2023-34197.html

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.6

Confidence

High

EPSS

0.003

Percentile

66.2%

JSON

Related for CVE-2023-34197