CVE-2023-29443 XML external entity in n/a

What is CVE-2023-29443?

CVE-2023-29443 is a medium-severity vulnerability in Zohocorp Manageengine Servicedesk Plus, published on 26 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.

Weakness: CWE-611

Which versions are affected by CVE-2023-29443?

It affects 4 products.

Products include Zohocorp Manageengine Assetexplorer, Zohocorp Manageengine Servicedesk Plus, Zohocorp Manageengine Servicedesk Plus Msp, Zohocorp Manageengine Supportcenter Plus.

How do I fix CVE-2023-29443?

No fix has been published for CVE-2023-29443 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-29443 being exploited?

There is no known exploitation of CVE-2023-29443 in the wild and no public exploit code.

Other vulnerabilities in Zohocorp Manageengine Servicedesk Plus

• CVE-2021-20110 Integer overflow in Manage Engine Asset Explorer Agent Critical 9.8
• CVE-2019-12994 Server-side request forgery in n/a Critical 9.1
• CVE-2019-12959 Server-side request forgery in n/a High 8.8
• CVE-2019-14693 XML external entity in n/a High 8.5
• CVE-2023-26601 Denial of service in n/a High 7.5

All Zohocorp Manageengine Servicedesk Plus vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h7wh-8cwv-qqm6.