OpenCVE

Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Zohocorp	Manageengine Servicedesk Plus Manageengine Servicedesk Plus Msp Manageengine Supportcenter Plus

Configuration 1 [-]

OR	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus::::::::
	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.2:14200::::::
	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.2:14201::::::

Configuration 2 [-]

OR	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp::::::::
	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14200::::::
	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14201::::::
	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14202::::::

Configuration 3 [-]

OR	cpe:2.3:a:zohocorp:manageengine_supportcenter_plus::::::::
	cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.2:14200::::::
	cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.2:14201::::::

No data.

References

Link	Providers
https://www.manageengine.com/products/service-desk/CVE-2023-34197.html

History

Wed, 13 Nov 2024 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-863
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-07-07T00:00:00

Updated: 2024-11-13T21:03:43.380Z

Reserved: 2023-05-30T00:00:00

Link: CVE-2023-34197

Vulnrichment

Updated: 2024-08-02T16:01:54.246Z

NVD

Status : Modified

Published: 2023-07-07T13:15:09.273

Modified: 2024-11-13T21:35:01.683

Link: CVE-2023-34197

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*", "matchCriteriaId": "D69A22E7-FF66-43A0-83FF-4D0ADF25B33D", "versionEndExcluding": "14.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.2:14200:*:*:*:*:*:*", "matchCriteriaId": "4A89D0AC-E27C-4C35-8E2E-44DF0BBD6FF5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.2:14201:*:*:*:*:*:*", "matchCriteriaId": "19A77447-AA60-4011-A64B-0A065F43279E", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E2D7250-8F17-4A29-BB1F-755A9DF0E3E6", "versionEndExcluding": "14.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14200:*:*:*:*:*:*", "matchCriteriaId": "E2141BB9-EEB1-4648-A98F-8E56463E3D02", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14201:*:*:*:*:*:*", "matchCriteriaId": "122F5CF4-E718-4E0F-90BB-173EC4A726E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.2:14202:*:*:*:*:*:*", "matchCriteriaId": "DBDD2838-53B0-425F-B5FF-FD6DD6587C53", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C96B503-E3D8-48E3-9D91-0EDD125A51B2", "versionEndExcluding": "14.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.2:14200:*:*:*:*:*:*", "matchCriteriaId": "3F3F6B18-309E-402B-B5B6-857A71FCA675", "vulnerable": true}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.2:14201:*:*:*:*:*:*", "matchCriteriaId": "2578CF13-141C-4DE4-9209-52A0CE5892C8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications."}], "id": "CVE-2023-34197", "lastModified": "2024-11-13T21:35:01.683", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-07T13:15:09.273", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.manageengine.com/products/service-desk/CVE-2023-34197.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}