CVE-2019-8394

Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.

Score

CVSS 3.1 7.5 High

Status

Analyzed - cve@mitre.org

Published

2019-02-17

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2021-11-03, action due 2022-05-03: Apply updates per vendor instructions.

Weaknesses

CWE-434

Affected products

• Manageengine Servicedesk Plus (Zohocorp)

References

• http://www.securityfocus.com/bid/107129
• https://www.exploit-db.com/exploits/46413/
• https://www.manageengine.com/products/service-desk/readme.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8394