CVE-2023-4769
Server-Side Request Forgery in ManageEngine Desktop Central
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability could allow an authenticated attacker to launch targeted attacks, such as a cross-port attack, service enumeration and other attacks via HTTP requests.
Se ha encontrado una vulnerabilidad SSRF en ManageEngine Desktop Central que afecta a la versión 9.1.0, específicamente al componente /smtpConfig.do. Esta vulnerabilidad podría permitir que un atacante autenticado lance ataques dirigidos, como un ataque entre puertos, enumeración de servicios y otros ataques a través de solicitudes HTTP.
*Credits:
Rafael Pedrero
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-09-05 CVE Reserved
- 2023-11-03 CVE Published
- 2024-09-05 CVE Updated
- 2024-09-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
- CAPEC-664: Server Side Request Forgery
References (1)
| URL | Tag | Source |
|---|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-manageengine-desktop-central | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Zohocorp Search vendor "Zohocorp" | Manageengine Desktop Central Search vendor "Zohocorp" for product "Manageengine Desktop Central" | 9.1.0 Search vendor "Zohocorp" for product "Manageengine Desktop Central" and version "9.1.0" | - |
Affected
| ||||||