CVE-2023-4768

Summary

CVE-2023-4768 is a newly discovered vulnerability in ManageEngine Desktop Central, specifically affecting version 9.1.0. This issue involves a CRLF injection vulnerability in the /STATE_ID/1613157927228/InvSWMetering.pdf endpoint. A remote attacker can exploit this flaw by injecting arbitrary HTTP headers and triggering HTTP response splitting attacks through the fileName parameter. Successful exploitation could result in serious security implications, such as unauthorized access or data exfiltration. It is highly recommended that users of impacted versions upgrade to the latest patch to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.