Security advisory

Privilege escalation vulnerability in the Release module

CVE ID : CVE-2023-34197

Product Name	Severity	Affected Version(s)	Fixed Version	Fixed On
ServiceDesk Plus	Low	14201 and below	14202	May 06, 2023
ServiceDesk Plus MSP	Low	14202 and below	14300	June 19, 2023
SupportCenter Plus	Low	14201 and below	14300	June 19, 2023

Details

A privilege escalation vulnerability in the Release module allowed unprivileged users to access the Reminders of a release ticket and modify it.

Impact

The vulnerability can be exploited by unprivileged users to view, create, edit or delete reminders for Releases.

Steps to upgrade

1. Download the latest upgrade pack from the following links for the respective products:
   • ServiceDesk Plus
   • ServiceDesk Plus MSP
   • SupportCenter Plus
2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements

This vulnerability was reported by 4rth4s on our bug bounty portal.

If you have any questions or concerns, please contact product support at the email addresses below.

ServiceDesk Plus: support@servicedeskplus.com

ServiceDesk Plus MSP: support@servicedeskplusmsp.com

SupportCenter Plus: support@supportcenterplus.com