Lucene search
Piotr Bazydlo (@chudypb) of Trend Micro Zero Day InitiativeZDI-23-229HistoryMar 09, 2023 - 12:00 a.m.
ManageEngine ServiceDesk Plus MSP generateSQLReport Improper Input Validation Privilege Escalation Vulnerability
2023-03-0900:00:00
Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative
www.zerodayinitiative.com
18
manageengine
servicedesk plus msp
privilege escalation
improper input validation
vulnerability
authentication
generatesqlreport
EPSS
0.002
Percentile
59.2%
This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine ServiceDesk Plus MSP. Authentication is required to exploit this vulnerability. The specific flaw exists within the generateSQLReport function. The issue results from the lack of proper validation of user-supplied data. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.
Related
nessus
nessus
ManageEngine ServiceDesk Plus MSP < 14.0 Build 14000
2023-11-15 00:00:00
ManageEngine SupportCenter Plus < 14.0 Build 14000 Privilege Escalation
2023-03-17 00:00:00
ManageEngine ServiceDesk Plus < 14.0 Build 14104 Multiple Vulnerabilities
2023-03-15 00:00:00
cvelist
cvelist
CVE-2023-26600
2023-03-06 00:00:00
prion
prion
Privilege escalation
2023-03-06 20:15:00
cve
cve
CVE-2023-26600
2023-03-06 20:15:09
nvd
nvd
CVE-2023-26600
2023-03-06 20:15:09