CVE-2022-40771
ManageEngine ServiceDesk Plus getAsDoc XML External Entity Processing Information Disclosure Vulnerability
Severity Score
4.9
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.
Las versiones 13010 y anteriores de Zoho ManageEngine ServiceDesk Plus son vulnerables a un ataque de Entidad Externa XML (XXE) que conduce a la divulgación de información.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of ManageEngine ServiceDesk Plus. Authentication is required to exploit this vulnerability.
The specific flaw exists within the getAsDoc function. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM or to create a denial-of-service condition on the system.
*Credits:
Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-09-18 CVE Reserved
- 2022-11-21 CVE Published
- 2024-06-15 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-611: Improper Restriction of XML External Entity Reference
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.manageengine.com/products/service-desk/CVE-2022-40771.html | 2022-11-29 |
| URL | Date | SRC |
|---|---|---|
| https://manageengine.com | 2022-11-29 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Zohocorp Search vendor "Zohocorp" | Manageengine Servicedesk Plus Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" | < 14.0 Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" and version " < 14.0" | - |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Servicedesk Plus Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" | 14.0 Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" and version "14.0" | - |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Servicedesk Plus Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" | 14.0 Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" and version "14.0" | 14000 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Servicedesk Plus Msp Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" | < 13.0 Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" and version " < 13.0" | - |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Servicedesk Plus Msp Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" | 13.0 Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" and version "13.0" | - |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Servicedesk Plus Msp Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" | 13.0 Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" and version "13.0" | 13000 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | < 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version " < 11.0" | - |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | - |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11000 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11001 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11002 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11003 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11004 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11005 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11006 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11007 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11008 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11009 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11010 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11011 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11012 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11013 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11014 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11015 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11016 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11017 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11018 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11019 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11020 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11021 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11022 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11024 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Supportcenter Plus Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" | 11.0 Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0" | 11025 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | < 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version " < 6.9" | - |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | - |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6900 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6901 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6902 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6903 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6904 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6905 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6906 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6907 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6908 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6909 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6950 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6951 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6952 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6953 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6954 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6955 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6956 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6957 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6970 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6971 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6972 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6973 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6974 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6975 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6976 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6977 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6978 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6979 |
Affected
| ||||||
| Zohocorp Search vendor "Zohocorp" | Manageengine Assetexplorer Search vendor "Zohocorp" for product "Manageengine Assetexplorer" | 6.9 Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9" | 6980 |
Affected
| ||||||