| Package | Affected versions | Patched versions |
|---|---|---|
| manageengine assetexplorer | = 6.9 | |
| manageengine servicedesk plus | = 14.1< 14.1 | 14.1 |
| manageengine servicedesk plus msp | = 14.0< 14.0 | 14.0 |
| manageengine supportcenter plus | = 14.0< 14.0 | 14.0 |
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free