CVE-2023-29443

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.

Score

CVSS 3.1 4.9 Medium

Status

Modified - cve@mitre.org

Published

2023-04-26

Last modified

2025-02-03

Weaknesses

CWE-611

Affected products

• Manageengine Assetexplorer (Zohocorp)
• Manageengine Servicedesk Plus (Zohocorp)
• Manageengine Servicedesk Plus Msp (Zohocorp)
• Manageengine Supportcenter Plus (Zohocorp)

References

• https://www.manageengine.com/products/service-desk/CVE-2023-29443.html