CVE-2023-29443

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-26 · updated 2026-06-17
Weakness: CWE-611

Description

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.

Affected products

Manage Engine Asset Explorer Agent: 6.9-6980, 6.9-6981, 6.9-6982, 6.9-6983, 6.9-6984, 6.9-6985 (+3)
ManageEngine ServiceDesk Plus: before 14.1; 14.1, 14.1-14100, 14.1-14101, 14.1-14102, 14.1-14103, 14.1-14104 — fixed in 14.1
Zohocorp Manageengine Servicedesk Plus Msp: before 14.0; 14.0-14000, 14.0-14001 — fixed in 14.0
Zohocorp Manageengine Supportcenter Plus: before 14.0; 14.0-14000, 14.0-14001 — fixed in 14.0

How to fix

Upgrade to a fixed version: ManageEngine ServiceDesk Plus 14.1; Zohocorp Manageengine Servicedesk Plus Msp 14.0; Zohocorp Manageengine Supportcenter Plus 14.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-29443 or the next vulnerability affects your stack