VulnerabilityModified
CVE-2023-29443
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a…
MEDIUM 4.9EPSS 3.03%
Does this matter?
Lower severity and a low EPSS score (3.03%). Track it; it rarely justifies an emergency change on its own.
Description
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.
- CVSS 3.1
- 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 3.03% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-611
- Affected
- zohocorp/manageengine assetexplorer · zohocorp/manageengine servicedesk plus · zohocorp/manageengine servicedesk plus msp · zohocorp/manageengine supportcenter plus
- Source
- cve@mitre.org
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.