Security Advisory – Important Security Fix Released for ManageEngine ITSM Products

Severity
CRITICAL

Details
By sending a specially crafted malformed request under specific circumstances, a remote attacker can cause unauthenticated remote code execution due to the usage of a vulnerable third-party library on the affected server. The library has now been updated to a safer version.

This advisory is applicable only when you have configured SAML-based SSO at least once in the past, regardless of your current SAML-based SSO status.

If you are using ManageEngine’s unified agent from Endpoint Central for asset discovery, please upgrade to the latest version of Endpoint Central, 10.1.2220.18, using the links below for the appropriate product.

• ServiceDesk Plus
• AssetExplorer

What should you do?

ManageEngine recommends that you upgrade ServiceDesk Plus, ServiceDesk Plus MSP, AssetExplorer, and SupportCentre Plus to the latest version immediately.

Steps to upgrade
Download the latest service pack by clicking on the appropriate product

• ServiceDesk Plus
• ServiceDesk Plus MSP
• AssetExplorer
• SupportCenter Plus

Apply the latest build to your existing product installation as per the upgrade pack instructions in the links provided above.

Important Note: Don’t forget to make a backup of your installation folder before you upgrade and keep the backup in a separate location. If anything goes wrong, you will have this copy as a backup, which will keep all your settings intact. If you’re using an MS SQL server as the back-end database, back up the application database before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

For more information or if you have any questions/concerns feel free to contact us