Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.

The version of ManageEngine ServiceDesk Plus running on the remote host is prior to 14.0 Build 14001. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An XML external entity (XXE) vulnerability due to a flaw in the Analytics Plus integration.
    Threat actors with admin role access can retrieve local files from the server. (CVE-2022-40771)

  - A privilege escalation vulnerability allows an adversary to access restricted data in the     Postgres database setup by using a specific PostgreSQL function in the query, which enables     bypassing the validation mechanism. (CVE-2022-40772)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ManageEngine SupportCenter Plus prior to 11.0 Build 11026 is running on the remote web server. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A remote code execution vulnerability due to a flaw in the Analytics Plus integration input     field validation. Vulnerability requires an administrator role access. (CVE-2022-40770)

  - An XML external entity (XXE) vulnerability due to a flaw in the Analytics Plus integration.
    Threat actors with admin role access can retrieve local files from the server. (CVE-2022-40771)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An XML external entity (XXE) vulnerability exists in ManageEngine AssetExplorer 6.9 Build 6980 due to a flaw in the Analytics Plus integration. Threat actors with admin role access can retrieve local files from the server running the affected products.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

An XML external entity (XXE) vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 13.0 Build 13001 due to a flaw in the Analytics Plus integration. Threat actors with admin role access can retrieve local files from the server running the affected products.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

ID	Name	Product	Family	Severity
168361	ManageEngine ServiceDesk Plus < 14.0 Build 14001 Multiple Vulnerabilities	Nessus	CGI abuses	medium
168358	ManageEngine SupportCenter Plus < 11.0 Build 11026 Multiple Vulnerabilities	Nessus	CGI abuses	high
168357	ManageEngine AssetExplorer 6.9 Build 6980 XXE	Nessus	CGI abuses	medium
168353	ManageEngine ServiceDesk Plus MSP < 13.0 Build 13001 XXE	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2022-40771

medium

Tenable Plugins

medium

high

medium

medium