CVE-2023-22964

CVSS V2 None CVSS V3 None
Description
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled.
Overview
  • CVE ID
  • CVE-2023-22964
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-01-20T17:15:11
  • Last Modified Date
  • 2023-01-27T15:04:24
Weakness Enumerations
CWE URL
CWE-287 http://cwe.mitre.org/data/definitions/287.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10600:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10601:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10602:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10603:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10604:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10605:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10606:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10607:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10608:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10609:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10610:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:13.0:13000:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:13.0:13001:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:13.0:13002:*:*:*:*:*:* 1 OR
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:13.0:13003:*:*:*:*:*:* 1 OR
References
Reference URL Reference Tags
https://manageengine.com
https://www.manageengine.com/products/service-desk-msp/cve-2023-22964.html
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-22964
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22964
History
Created Old Value New Value Data Type Notes
2023-01-20 18:13:09 Added to TrackCVE
2023-01-23 15:14:16 2023-01-23T15:08:08 CVE Modified Date updated
2023-01-23 15:14:16 Received Awaiting Analysis Vulnerability Status updated
2023-01-23 16:14:30 2023-01-23T15:15:18 CVE Modified Date updated
2023-01-23 16:14:32 Zoho ManageEngine ServiceDesk Plus MSP through 13003 is vulnerable to authentication bypass due to the unsafe LDAP configuration (issue 1 of 2). Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled. Description updated
2023-01-27 15:14:31 2023-01-27T15:04:24 CVE Modified Date updated
2023-01-27 15:14:31 Awaiting Analysis Analyzed Vulnerability Status updated
2023-01-27 15:14:32 Weakness Enumeration new
2023-01-27 15:14:34 CPE Information updated