Security advisory

Denial of Service vulnerability in image upload

CVE ID : CVE-2023-26601

Product Name Severity Affected Version(s) Fixed Version Fixed On
ServiceDesk Plus Medium 14103 and below 14104 Jan. 24, 2023
ServiceDesk Plus MSP Medium 14000 and below 14001 Feb. 16, 2023
SupportCenter Plus Medium 14000 and below 14001 Feb. 20, 2023
AssetExplorer Medium 6987 and below 6988 Jan. 24, 2023

Details

This vulnerability allows an attacker to exploit the way an API method allocates memory by sending a small image file with a large size defined in the header, causing the application to crash or become unresponsive.

Impact

Users may not be able to access the application.

How was it resolved?

We have added limits for image pixel size and type validation for parameters.

Steps to upgrade

  1. Download the latest upgrade pack from the following links for the respective products:
  2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Acknowledgements

This vulnerability was reported by Piotr Bazydlo (@chudyPB) of Trend Micro Zero Day Initiative.

If you have any questions or concerns, please contact product support at the email addresses below.

ServiceDesk Plus: support@servicedeskplus.com

ServiceDesk Plus MSP: support@servicedeskplusmsp.com

SupportCenter Plus: support@supportcenterplus.com

AssetExplorer: assetexplorer-support@manageengine.com

Let's support faster, easier, and together