Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. (This also affects Asset Explorer before 6977 with authentication.)

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 13.0 Build 13008. It is, therefore, affected by a vulnerability as referenced in the service-desk_cve-2022-35403 advisory.

  - Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus     before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation     email. (This also affects Asset Explorer before 6977 with authentication.) (CVE-2022-35403)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ManageEngine AssetExplorer installed on the remote host is prior to 6.9 Build 6977. It is, therefore, affected by a vulnerability as referenced in the asset-explorer_cve-2022-35403 advisory.

  - Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus     before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation     email. (This also affects Asset Explorer before 6977 with authentication.) (CVE-2022-35403)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 11.0 Build 11022. It is, therefore, affected by a vulnerability as referenced in the support-center_cve-2022-35403 advisory.

  - Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus     before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation     email. (This also affects Asset Explorer before 6977 with authentication.) (CVE-2022-35403)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 10.6 Build 10606. It is, therefore, affected by a vulnerability as referenced in the service-desk-msp_cve-2022-35403 advisory.

  - Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus     before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation     email. (This also affects Asset Explorer before 6977 with authentication.) (CVE-2022-35403)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185762	ManageEngine ServiceDesk Plus < 13.0 Build 13008	Nessus	CGI abuses	high
185757	ManageEngine AssetExplorer < 6.9 Build 6977	Nessus	CGI abuses	high
185750	ManageEngine SupportCenter Plus < 11.0 Build 11022	Nessus	CGI abuses	high
185743	ManageEngine ServiceDesk Plus MSP < 10.6 Build 10606	Nessus	CGI abuses	high

Detections

Analytics

CVE-2022-35403

high

Tenable Plugins

high

high

high

high