Threats tagged 'ghsa-4cwf-239q-xjfq'

An authenticated remote code execution vulnerability exists in Zohocorp ManageEngine products including AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus. The flaw affects versions below 7860 for AssetExplorer, below 15290 for ServiceDesk Plus, and below 15150 for both ServiceDesk Plus MSP and SupportCenter Plus. Exploitation requires an authenticated user with the Create Query Reports permission to craft malicious database queries that execute arbitrary commands on the server.