CVE:CVE-2023-29443
CNNVD:CNNVD-202304-2114
ZOHO ManageEngine ServiceDesk Plus（SDP）是美国卓豪（ZOHO）公司的一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。
ZOHO ManageEngine ServiceDesk Plus 14105之前版本存在代码问题漏洞，该漏洞源于具有 SDAdmin 角色的攻击者可以恶意更改服务器配置，从而导致 XML 外部实体 (XXE) 攻击。
solution:Upgrade zohocorp manageengine_assetexplorer to a higher version than 6.9:6980,6.9:6981,6.9:6982,6.9:6983,6.9:6984,6.9:6985,6.9:6986,6.9:6987,6.9:6988,and avoid the version 6.9:6980,6.9:6981,6.9:6982,6.9:6983,6.9:6984,6.9:6985,6.9:6986,6.9:6987,6.9:6988; Upgrade zohocorp manageengine_servicedesk_plus to a higher version than 14.1,14.1,14.1:14100,14.1:14101,14.1:14102,14.1:14103,14.1:14104,and avoid the version (,14.1),14.1,14.1:14100,14.1:14101,14.1:14102,14.1:14103,14.1:14104; Upgrade zohocorp manageengine_servicedesk_plus_msp to a higher version than 14.0,14.0:14000,14.0:14001,and avoid the version (,14.0),14.0:14000,14.0:14001; Upgrade zohocorp manageengine_supportcenter_plus to a higher version than 14.0,14.0:14000,14.0:14001,and avoid the version (,14.0),14.0:14000,14.0:14001