CVE-2022-40772

MEDIUM

Zoho ManageEngine ServiceDesk Plus <13010 - Auth Bypass

Title source: llm

Description

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module.

References (2)

Core 2

Core References

Vendor Advisory

https://manageengine.com

Patch, Vendor Advisory

https://www.manageengine.com/products/service-desk/CVE-2022-40772.html

Scores

CVSS v3 6.5

EPSS 0.0054

EPSS Percentile 67.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

Status published

Products (7)

zohocorp/manageengine_assetexplorer 6.9 (30 CPE variants)

zohocorp/manageengine_assetexplorer < 6.9

zohocorp/manageengine_servicedesk_plus 14.0 (2 CPE variants)

zohocorp/manageengine_servicedesk_plus < 14.0

zohocorp/manageengine_servicedesk_plus_msp 10.6 (10 CPE variants)

zohocorp/manageengine_servicedesk_plus_msp < 10.6

zohocorp/manageengine_supportcenter_plus 11.0 (5 CPE variants)

Published Nov 23, 2022

Tracked Since Feb 18, 2026