Product NameAffected Version(s)Fixed Version(s)Fixed on
ServiceDesk Plus14000 series
13000 series
12000 series
11300 series
14004
13012
12009
11315
27/10/2022
ServiceDesk Plus MSP13000 series
10600 series
10500 series
13001
10610
10538
27/10/2022
AssetExplorer 6970 series
6950 series
6900 series
6983
6958
6911
27/10/2022
SupportCenter Plus11000 series1102628/10/2022

Severity
CRITICAL

Details
By sending a specially crafted malformed request under specific circumstances, a remote attacker can cause unauthenticated remote code execution due to the usage of a vulnerable third-party library on the affected server. The library has now been updated to a safer version.

This advisory is applicable only when you have configured SAML-based SSO at least once in the past, regardless of your current SAML-based SSO status.

If you are using ManageEngine’s unified agent from Endpoint Central for asset discovery, please upgrade to the latest version of Endpoint Central, 10.1.2220.18, using the links below for the appropriate product.

What should you do?

ManageEngine recommends that you upgrade ServiceDesk Plus, ServiceDesk Plus MSP, AssetExplorer, and SupportCentre Plus to the latest version immediately.

Steps to upgrade
Download the latest service pack by clicking on the appropriate product

Apply the latest build to your existing product installation as per the upgrade pack instructions in the links provided above.

Important Note: Don’t forget to make a backup of your installation folder before you upgrade and keep the backup in a separate location. If anything goes wrong, you will have this copy as a backup, which will keep all your settings intact. If you’re using an MS SQL server as the back-end database, back up the application database before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

For more information or if you have any questions/concerns feel free to contact us

This article is relevant to:
IT SecurityManageEngineSecurity AdvisoryService Desk

You may be interested in these other recent articles

ManageEngine ServiceDesk Plus Cloud Build Release Information

20 June 2024

Summary details of the current Build Release information for ManageEngine ServiceDesk Plus Cloud Edition. All upgrades are performed by the Zoho Cloud team. Should you…

Read more

Security Advisory – Important Security Fix Released For ManageEngine Solutions

17 June 2024

Product Name Affected Version(s) Fixed Version Fixed on Password Manager Pro 12430 and below 12431 14/06/2024 PAM360 7000 and below 7001 14/06/2024 DetailsAn SQL injection…

Read more

ManageEngine ADSelfService Plus Build Release Information

14 June 2024

The current build release information for ManageEngine ADSelfService Plus is summarised below. Scroll down for more information. You can download the latest service packs here.…

Read more

ManageEngine Password Manager Pro Build Release Information

The current build release information for ManageEngine Password Manager Pro is summarised below. Scroll down for more information. You can download the latest service packs…

Read more

ManageEngine OpManager Build Release Information

13 June 2024

Summary details of the current build release information for ManageEngine OpManager. Scroll the above to view more release details. Download the latest service packs here.…

Read more