CVE ID: CVE-2022-35403
|Product Name||Severity||Affected Version(s)||Fixed Version||Fixed On|
|ServiceDesk Plus||High||13007 and below||13008||July 7, 2022|
|ServiceDesk Plus MSP||High||10605 and below||10606||July 11, 2022|
|SupportCenter Plus||High||11021 and below||11022||July 11, 2022|
|AssetExplorer||Medium||6976 and below||6977||July 7, 2022|
This file disclosure vulnerability allows non-login users to download local files from the ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus server machines by sending a crafted email for ticket creation. The same vulnerability affects AssetExplorer too which falls under medium severity since it needs authentication to exploit.
We fixed this issue by adding additional checks to process the email content to avoid the local file disclosure vulnerability in ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus and AssetExplorer.
This vulnerability allows non-login users to download local files from the server machine.
Steps to upgrade
- Download the latest upgrade pack from the following links for the respective product:
- ServiceDesk Plus – https://www.manageengine.com/products/service-desk/on-premises/migration-sequence.html
- ServiceDesk Plus MSP – https://www.manageengine.com/products/service-desk-msp/service-packs-hotfix.html
- SupportCenter Plus – https://www.manageengine.com/products/support-center/service-packs.html
- AssetExplorer – https://www.manageengine.com/products/asset-explorer/service-packs.html
- Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.
Please follow the forum post for the respective products as mentioned below for any further updates regarding this vulnerability:
This issue was reported by ManageEngine’s internal security team on our bug bounty portal.
If you have any questions or concerns, please contact product support for further details at the below-mentioned email addresses.
ServiceDesk Plus: firstname.lastname@example.org
ServiceDesk Plus MSP email@example.com
SupportCenter Plus: firstname.lastname@example.org
Important note: As always, make a copy of the entire application installation folder before applying the upgrade, and keep the copy in a separate location. If anything goes wrong during the upgrade, you will have this copy as a backup, which will keep all your settings intact. If you are using an MS SQL Server as a back-end database, back up the application database before upgrading. Once the upgrade is successfully completed, remember to delete the backup.
This article is relevant to:ManageEngineSecurity AdvisoryService Desk
Other recent articles in the same category
You may be interested in these other recent articles
25 November 2023
The current build release information for ManageEngine ADSelfService Plus is summarised below. Scroll down for more information. You can download the latest service packs here.…Read more
23 November 2023
Summary details of the current Build Release information for ManageEngine ServiceDesk Plus Cloud Edition. All upgrades are performed by the Zoho Cloud team. Should you…Read more
18 November 2023
Summary details of the current build release information for ManageEngine ADManager Plus. Scroll the above to view more release details. Download the latest service packs…Read more
16 November 2023
Summary details of the current Build Release information for ManageEngine Endpoint Central. Note: Desktop Central changing its name to Endpoint Central will not affect the…Read more