This document addresses a privilege escalation vulnerability identified in ManageEngine Endpoint Central MSP.
CVE ID: CVE-2022-23863
Update Released Build: 10.1.2137.10
Update Released Date: January 25, 2022
A privilege escalation vulnerability in Endpoint Central MSP (CVE-2022-23863) was identified which may allow an authenticated user to change passwords of a more privileged account. This has now been fixed and released on January 25, 2022 and the mitigation is available in build 10.1.2137.10.
If you are on build 10.1.2137.9:
If you just upgraded to 10.1.2137.9 that was released on January 17, 2022, we have exclusively released a quick fix for you. Quick fixes are QPM upgrades instead of PPM upgrades, which are faster and easier to apply. The purpose of this quick fix is to cut your transition load of back-to-back PPM upgrades. If you do not wish to apply the quick fix, you can upgrade to the latest version using PPM, as normally done. QPM upgrade or PPM upgrade, either way you will reach the latest version of Endpoint Central MSP. For more clarity on the quick fix, read this document.
Please download the quick fix here.
For other builds:
Please upgrade to the latest build 10.1.2137.10 as normally done. You can visit our service packs page and download the latest build. Alternatively, you can also follow the below steps:
1. Will the QPM change the product version to the latest?
Answer: Yes, applying the quick fix (QPM upgrade) will change your build version to 10.1.2137.10 which is the latest. After applying the quick fix (QPM upgrade), you will move to the latest version of Endpoint Central MSP.
2. Is QPM temporary fix and should I install the PPM later?
Answer: No, QPM alone will suffice for this fix. It is a quick and effective replacement of PPM upgrade. Since QPM upgrade is smaller and quicker to apply, it'll help you avoid difficulties that come with back-to-back PPM upgrades.
3. Will it affect upcoming service pack upgrades?
Answer: No
4. My build version is older than 10.1.2137.9, can I use this quick fix?
Answer: No, this quick fix is exclusively generated for 10.1.2137.9. If you are not in this build, it will not work for you. As per normal, you need to upgrade to the latest build 10.1.2137.10 using PPM.
5. How to verify if the quick fix is applied?
Answer: In Endpoint Central MSP console, navigate to Support -> Upgrade Details. If the fix is successfully applied, you will see the quick fix displayed under the 'Upgrade Details' tab. If the fix installation has failed, a failure alert will be displayed there.
For any further queries on this, please reach out to Endpoint Central MSP support at msp-desktopcentral-support@manageengine.com.
Free Edition