Security advisory

Privilege escalation vulnerability in query reports

CVE ID : CVE-2022-40772

Details

This vulnerability allows an adversary to access restricted data in the Postgres database setup by using a specific PostgreSQL function in the query, which enables bypassing the validation mechanism.

Impact

Users who have access to query reports can access restricted data.

Steps to upgrade

1. Download the latest upgrade pack from the following links for the respective products:
   • ServiceDesk Plus - https://www.manageengine.com/products/service-desk/on-premises/migration-sequence.html
   • ServiceDesk Plus MSP - https://www.manageengine.com/products/service-desk-msp/service-packs-hotfix.html
   • SupportCenter Plus - https://www.manageengine.com/products/support-center/service-packs.html
   • AssetExplorer - https://www.manageengine.com/products/asset-explorer/service-packs.html
2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements

This vulnerability was reported by Piotr Bazydlo (@chudypb) of Trend Micro's Zero Day Initiative.

If you have any questions or concerns, please contact product support for further details at the below-mentioned email addresses.

ServiceDesk Plus: support@servicedeskplus.com

ServiceDesk Plus MSP: support@servicedeskplusmsp.com

SupportCenter Plus: support@supportcenterplus.com

AssetExplorer: assetexplorer-support@manageengine.com