CVE-2023-29443

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.manageengine.com/products/service-desk/CVE-2023-29443.htmlVendor Advisory
https://www.manageengine.com/products/service-desk/CVE-2023-29443.htmlVendor Advisory

Timeline

Published: Apr 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-294447.3An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to CVE-2023-294457.8An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to CVE-2023-294464.7An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project fi CVE-2023-294475.3An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server CVE-2023-294494.9JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/gl CVE-2023-29455.4Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-294507.5JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the CVE-2023-294517.5Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.CVE-2023-294525.4Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when sele CVE-2023-294539.8Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, si CVE-2023-294545.4Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the CVE-2023-294556.1Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim'