medium6.5Public exploit code
CVE-2019-12252
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions2019-05-22 · webapps · multiple
Impact
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Servicedesk Plus | through 10.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/153029/Zoho-ManageEngine-ServiceDesk-Plus-Privilege-Escalation.html
- http://www.securityfocus.com/bid/108456
- https://github.com/tuyenhva/CVE-2019-12252
- https://www.manageengine.com/products/service-desk/readme.html
- http://packetstormsecurity.com/files/153029/Zoho-ManageEngine-ServiceDesk-Plus-Privilege-Escalation.html
- http://www.securityfocus.com/bid/108456
- https://github.com/tuyenhva/CVE-2019-12252
- https://www.manageengine.com/products/service-desk/readme.html