SB2023012510 - Multiple vulnerabilities in Zoho ManageEngine ServiceDesk Plus
Published: January 25, 2023 Updated: March 9, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Cleartext transmission of sensitive information (CVE-ID: N/A)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software uses insecure communication channel to transmit passwords in backup scheduling. A remote attacker with ability to intercept network traffic can gain access to sensitive data.
2) Stored cross-site scripting (CVE-ID: N/A)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in request life cycle. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) Stored cross-site scripting (CVE-ID: CVE-2023-23074)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Advanced Portal product tour. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Improper access control (CVE-ID: CVE-2023-26600)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to improper access restrictions within the generateSQLReport function. A remote user can escalate privileges within the application.
5) Inclusion of Sensitive Information in Log Files (CVE-ID: N/A)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.
6) Improper Authentication (CVE-ID: N/A)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in Two-Factor Authentication login page. A remote attacker can bypass 2FA authentication process and gain unauthorized access to the application.
7) Improper access control (CVE-ID: N/A)
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions when associating requests from projects. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.
8) Improper access control (CVE-ID: N/A)
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions when disassociating requests from projects. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.
9) Improper access control (CVE-ID: N/A)
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions when associating projects from requests. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.
10) Resource exhaustion (CVE-ID: CVE-2023-26601)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in the images upload feature (ImageUploadServlet). A remote user can upload unlimited number of images, consume all available disk space and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://www.manageengine.com/products/service-desk/on-premises/readme.html#14104
- https://www.manageengine.com/products/service-desk/CVE-2023-26600.html
- https://www.zerodayinitiative.com/advisories/ZDI-23-229/
- https://www.manageengine.com/products/service-desk/CVE-2023-26601.html
- https://www.zerodayinitiative.com/advisories/ZDI-23-230/