CVE-2021-28023

CRITICAL 9.8CVE-2021-28023 · Published 08/11/2021 · updated 17/06/2026

In short

CVE-2021-28023 is a CRITICAL (CVSS 9.8) vulnerability affecting servicetonic (servicetonic).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 71.7% of all vulnerabilities.
Fix: update to 9.0.035937 or later.

Package	Affected versions	Patched versions
servicetonic servicetonic	`< 9.0.035937`	`9.0.035937`

Description

Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths.

References

servicetonic.com · Product
srlabs.de/bites/chaining-three-zero-day-exploits-in-itsm-software-servicetonic-for-remote-code-execution · Exploit

More vulnerabilities in servicetonic

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free