Security advisory

Privilege escalation vulnerability in query reports

CVE ID : CVE-2023-26600

Product Name	Severity	Affected Version(s)	Fixed Version	Fixed On
ServiceDesk Plus	Medium	14103 and below	14104	Jan. 24, 2023
ServiceDesk Plus MSP	Medium	13004 and below	14000	Jan. 23, 2023
SupportCenter Plus	Medium	11027 and below	14000	Feb. 02, 2023
AssetExplorer	Medium	6987 and below	6988	Jan. 24, 2023

Details

This vulnerability allows an attacker to gain access to restricted data in a Postgres database system by utilizing a certain PostgreSQL function in the query, allowing the validation process to be bypassed.

Impact

Users who have access to query reports can access restricted data.

Steps to upgrade

1. Download the latest upgrade pack from the following links for the respective products:
   • ServiceDesk Plus
   • ServiceDesk Plus MSP
   • SupportCenter Plus
   • AssetExplorer
2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements

This vulnerability was reported by Piotr Bazydlo (@chudyPB) of Trend Micro's Zero Day Initiative.

If you have any questions or concerns, please contact product support at the email addresses below.

ServiceDesk Plus: support@servicedeskplus.com

ServiceDesk Plus MSP: support@servicedeskplusmsp.com

SupportCenter Plus: support@supportcenterplus.com

AssetExplorer: assetexplorer-support@manageengine.com