CVE ID : CVE-2023-26601
| Product Name | Severity | Affected Version(s) | Fixed Version | Fixed On |
|---|---|---|---|---|
| ServiceDesk Plus | Medium | 14103 and below | 14104 | Jan. 24, 2023 |
| ServiceDesk Plus MSP | Medium | 14000 and below | 14001 | Feb. 16, 2023 |
| SupportCenter Plus | Medium | 14000 and below | 14001 | Feb. 20, 2023 |
| AssetExplorer | Medium | 6987 and below | 6988 | Jan. 24, 2023 |
Details
This vulnerability allows an attacker to exploit the way an API method allocates memory by sending a small image file with a large size defined in the header, causing the application to crash or become unresponsive.
Impact
Users may not be able to access the application.
How was it resolved?
We have added limits for image pixel size and type validation for parameters.
Steps to upgrade
Acknowledgements
This vulnerability was reported by Piotr Bazydlo (@chudyPB) of Trend Micro Zero Day Initiative.
If you have any questions or concerns, please contact product support at the email addresses below.
ServiceDesk Plus: support@servicedeskplus.com
ServiceDesk Plus MSP: support@servicedeskplusmsp.com
SupportCenter Plus: support@supportcenterplus.com
AssetExplorer: assetexplorer-support@manageengine.com