CVE-2017-11512

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.

Score

CVSS 3.0 7.5 High

Status

Modified - vulnreport@tenable.com

Published

2017-11-08

Last modified

2024-09-16

Weaknesses

CWE-22

Affected products

• Servicedesk (Manageengine)
• Manageengine Servicedesk (Zoho)

References

• http://www.securityfocus.com/bid/101789
• https://www.tenable.com/security/research/tra-2017-31