ManageEngine ServiceDesk Plus and AssetExplorer RCE Vulnerability

Zohocorp ManageEngine AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus are affected by an authenticated remote code execution vulnerability in the Reports module.

An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.

Affected versions:

• AssetExplorer below 7860
• ServiceDesk Plus below 15290
• ServiceDesk Plus MSP below 15150
• SupportCenter Plus below 15150