CVE:CVE-2022-40771
CNNVD:CNNVD-202211-3387
ZOHO ManageEngine ServiceDesk Plus（SDP）是美国卓豪（ZOHO）公司的一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。
ZOHO ManageEngine ServiceDesk Plus 13010版本及之前版本存在安全漏洞。攻击者利用该漏洞泄露敏感信息，并执行XML外部实体攻击。
solution:Upgrade zohocorp manageengine_servicedesk_plus to a higher version than 14.0,14.0,14.0:14000,and avoid the version (,14.0),14.0,14.0:14000; Upgrade zohocorp manageengine_servicedesk_plus_msp to a higher version than 13.0,13.0,13.0:13000,and avoid the version (,13.0),13.0,13.0:13000; Upgrade zohocorp manageengine_supportcenter_plus to a higher version than 11.0,11.0,11.0:11000,11.0:11001,11.0:11002,11.0:11003,11.0:11004,11.0:11005,11.0:11006,11.0:11007,11.0:11008,11.0:11009,11.0:11010,11.0:11011,11.0:11012,11.0:11013,11.0:11014,11.0:11015,11.0:11016,11.0:11017,11.0:11018,11.0:11019,11.0:11020,11.0:11021,11.0:11022,11.0:11024,11.0:11025,and avoid the version (,11.0),11.0,11.0:11000,11.0:11001,11.0:11002,11.0:11003,11.0:11004,11.0:11005,11.0:11006,11.0:11007,11.0:11008,11.0:11009,11.0:11010,11.0:11011,11.0:11012,11.0:11013,11.0:11014,11.0:11015,11.0:11016,11.0:11017,11.0:11018,11.0:11019,11.0:11020,11.0:11021,11.0:11022,11.0:11024,11.0:11025; Upgrade zohocorp manageengine_assetexplorer to a higher version than 6.9,6.9,6.9:6900,6.9:6901,6.9:6902,6.9:6903,6.9:6904,6.9:6905,6.9:6906,6.9:6907,6.9:6908,6.9:6909,6.9:6950,6.9:6951,6.9:6952,6.9:6953,6.9:6954,6.9:6955,6.9:6956,6.9:6957,6.9:6970,6.9:6971,6.9:6972,6.9:6973,6.9:6974,6.9:6975,6.9:6976,6.9:6977,6.9:6978,6.9:6979,6.9:6980,and avoid the version (,6.9),6.9,6.9:6900,6.9:6901,6.9:6902,6.9:6903,6.9:6904,6.9:6905,6.9:6906,6.9:6907,6.9:6908,6.9:6909,6.9:6950,6.9:6951,6.9:6952,6.9:6953,6.9:6954,6.9:6955,6.9:6956,6.9:6957,6.9:6970,6.9:6971,6.9:6972,6.9:6973,6.9:6974,6.9:6975,6.9:6976,6.9:6977,6.9:6978,6.9:6979,6.9:6980