medium4.3Public exploit code
CVE-2019-10273
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ManageEngine ServiceDesk Plus 9.3 - User Enumeration2019-04-08 · webapps · java
Impact
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Servicedesk Plus | Version 9.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/152439/ManageEngine-ServiceDesk-Plus-9.3-User-Enumeration.html
- https://0x445.github.io/CVE-2019-10273/
- https://www.exploit-db.com/exploits/46674/
- http://packetstormsecurity.com/files/152439/ManageEngine-ServiceDesk-Plus-9.3-User-Enumeration.html
- https://0x445.github.io/CVE-2019-10273/
- https://www.exploit-db.com/exploits/46674/