CVE-2023-22964 : Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vu

Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled.

Published 2023-01-20 17:15:11

Updated 2023-01-27 15:04:24

Source MITRE

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2023-22964

Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10600
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10600:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10601
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10601:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10602
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10602:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10603
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10603:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10604
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10604:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10605
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10605:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10607
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10607:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10608
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10608:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10606
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10606:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10609
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10609:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 10.6 Update 10610
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10610:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 13.0 Update 13000
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:13.0:13000:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 13.0 Update 13001
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:13.0:13001:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 13.0 Update 13002
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:13.0:13002:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Servicedesk Plus Msp » Version: 13.0 Update 13003
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:13.0:13003:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-22964

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-22964

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	3.9	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2023-22964

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-22964

https://manageengine.com

ManageEngine - IT Operations and Service Management Software
Product

CVEs referencing this url
https://www.manageengine.com/products/service-desk-msp/cve-2023-22964.html

Authentication bypass vulnerability in Active Directory/LDAP
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-22964

Products affected by CVE-2023-22964

Exploit prediction scoring system (EPSS) score for CVE-2023-22964

CVSS scores for CVE-2023-22964

CWE ids for CVE-2023-22964

References for CVE-2023-22964