// For flags

CVE-2023-26600

ManageEngine ServiceDesk Plus MSP generateSQLReport Improper Input Validation Privilege Escalation Vulnerability

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilege escalation via query reports.

This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine ServiceDesk Plus MSP. Authentication is required to exploit this vulnerability.
The specific flaw exists within the generateSQLReport function. The issue results from the lack of proper validation of user-supplied data. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.

*Credits: Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-02-26 CVE Reserved
  • 2023-03-06 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
< 6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version " < 6.9"
-
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
-
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6900
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6901
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6902
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6903
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6904
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6905
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6906
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6907
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6908
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6909
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6950
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6951
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6952
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6953
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6954
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6955
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6956
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6957
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6970
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6971
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6972
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6973
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6974
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6975
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6976
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6977
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6978
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6979
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6980
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6981
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6982
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6983
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6984
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6985
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6986
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Assetexplorer
Search vendor "Zohocorp" for product "Manageengine Assetexplorer"
6.9
Search vendor "Zohocorp" for product "Manageengine Assetexplorer" and version "6.9"
6987
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus"
< 14.1
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" and version " < 14.1"
-
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus"
14.1
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" and version "14.1"
-
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus"
14.1
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" and version "14.1"
14100
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus"
14.1
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" and version "14.1"
14101
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus"
14.1
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" and version "14.1"
14102
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus"
14.1
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus" and version "14.1"
14103
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus Msp
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp"
< 13.0
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" and version " < 13.0"
-
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus Msp
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp"
13.0
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" and version "13.0"
-
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus Msp
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp"
13.0
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" and version "13.0"
13000
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus Msp
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp"
13.0
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" and version "13.0"
13001
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus Msp
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp"
13.0
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" and version "13.0"
13002
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus Msp
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp"
13.0
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" and version "13.0"
13003
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Servicedesk Plus Msp
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp"
13.0
Search vendor "Zohocorp" for product "Manageengine Servicedesk Plus Msp" and version "13.0"
13004
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
< 11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version " < 11.0"
-
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
-
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11000
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11001
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11002
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11003
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11004
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11005
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11006
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11007
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11008
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11009
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11010
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11011
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11012
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11013
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11014
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11015
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11016
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11017
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11018
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11019
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11020
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11021
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11022
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11024
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11025
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11026
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Supportcenter Plus
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus"
11.0
Search vendor "Zohocorp" for product "Manageengine Supportcenter Plus" and version "11.0"
11027
Affected