CVE:CVE-2022-40773
CNNVD:CNNVD-202211-2656
ZOHO ManageEngine ServiceDesk Plus（SDP）是美国卓豪（ZOHO）公司的一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。
ZOHO ManageEngine ServiceDesk Plus 10609之前的版本和SupportCenter Plus 11025之前的版本存在安全漏洞，该漏洞源于其容易发生权限升级允许用户在从列表视图导出请求的exportMickeyList期间获得敏感数据。
solution:Upgrade zohocorp manageengine_servicedesk_plus_msp to a higher version than 10.6,10.6,10.6:10600,10.6:10601,10.6:10602,10.6:10603,10.6:10604,10.6:10605,10.6:10606,10.6:10607,10.6:10608,and avoid the version (,10.6),10.6,10.6:10600,10.6:10601,10.6:10602,10.6:10603,10.6:10604,10.6:10605,10.6:10606,10.6:10607,10.6:10608; Upgrade zohocorp manageengine_supportcenter_plus to a higher version than 11.0,11.0,11.0:11000,11.0:11001,11.0:11002,11.0:11003,11.0:11004,11.0:11005,11.0:11006,11.0:11007,11.0:11008,11.0:11009,11.0:11010,11.0:11011,11.0:11012,11.0:11013,11.0:11014,11.0:11015,11.0:11016,11.0:11017,11.0:11018,11.0:11019,11.0:11020,11.0:11021,11.0:11022,11.0:11024,and avoid the version (,11.0),11.0,11.0:11000,11.0:11001,11.0:11002,11.0:11003,11.0:11004,11.0:11005,11.0:11006,11.0:11007,11.0:11008,11.0:11009,11.0:11010,11.0:11011,11.0:11012,11.0:11013,11.0:11014,11.0:11015,11.0:11016,11.0:11017,11.0:11018,11.0:11019,11.0:11020,11.0:11021,11.0:11022,11.0:11024