CVE-2023-34197
MediumCVSS 5.4Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
The Release module in Zoho ManageEngine ServiceDesk Plus before version 14202, ServiceDesk Plus MSP before version 14300, and SupportCenter Plus before version 14300 has a privilege escalation vulnerability that allows unprivileged users to access the Reminders of a release ticket and make modifications.
Risk Assessment
This vulnerability may lead to unauthorized changes in release tickets, potentially affecting the integrity of service management processes within the organization.
Recommendation
It is recommended to update to the latest versions of the software to mitigate this vulnerability and restrict access to the Release module to authorized users only.
Original NVD description (English source)
Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications.