Description
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.
Advisories 1
- WID-SEC-2023-1058 Zoho ManageEngine ServiceDesk Plus: Schwachstelle ermöglicht XML External Entity Angriff BSI CERT-Bund (WID) · Apr 20, 2023