CVE-2017-11511

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.

Score

CVSS 3.0 7.5 High

Status

Modified - vulnreport@tenable.com

Published

2017-11-08

Last modified

2024-09-17

Weaknesses

CWE-200, CWE-22

Affected products

• Servicedesk (Manageengine)
• Manageengine Servicedesk (Zoho)

References

• http://www.securityfocus.com/bid/101788
• https://www.tenable.com/security/research/tra-2017-31