high8.8Public exploit code
CVE-2019-10008
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an est…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Manage Engine ServiceDesk Plus 10.0 - Privilege Escalation2019-04-05 · webapps · jsp
Impact
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Servicedesk Plus | Version 9.3 |