Vulnerability Intelligence Report
CVE-2022-40773
Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view.
No Active Exploit Signals
CVSS Base Score
8.8
HIGH
Exploitability:2.9
Impact Score:5.9
EPSS Probability:4.54%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-20 ↗CWE-20 Improper Input Validation
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| zohocorp | manageengine_servicedesk_plus_msp | 10.6 |
| zohocorp | manageengine_supportcenter_plus | 11.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
4.545%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2022-09-18T00:00:00 |
| Published | 2022-11-12T00:00:00 |
| Last Updated | 2025-05-01T13:30:33 |
Community Chatter & Buzz