Security advisory

Non-login users can extract vendor currency details

Severity : Low

CVE ID : CVE-2022-25245

Details

Using the approval login URL, which is used to approve purchase details without a login to the application, non-login users are able to extract vendor currency details.

Impact

Users can extract all vendor currency details without logging in to the application.

Steps to upgrade

1. Download the latest upgrade pack from the following links for the respective product:
   • ServiceDesk Plus - https://www.manageengine.com/products/service-desk/on-premises/migration-sequence.html
   • AssetExplorer - https://www.manageengine.com/products/asset-explorer/service-packs.html
2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements

This issue was reported by Matt on our bug bounty portal.

Please contact the product support for further details at the below mentioned email addresses:

ServiceDesk Plus: support@servicedeskplus.com

AssetExplorer: assetexplorer-support@manageengine.com

For assistance, call us toll-free at +1.888.720.9500