PT-2011-3176 · Zoho · Manageengine Servicedesk Plus

Matias Blanco · Publicado 2011-09-20 · Atualizado 2018-10-09 · CVE-2011-1509

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus (SDP) versions 8012 and earlier

Description The issue concerns the encryption of passwords in cookies. It is related to the encryptPassword function in Login.js, which uses a Caesar cipher for encryption. This makes it easier for remote attackers to obtain sensitive information by sniffing the network.

Recommendations For ManageEngine ServiceDesk Plus (SDP) versions 8012 and earlier, as a temporary workaround, consider disabling the encryptPassword function in Login.js until a proper encryption method is implemented. Restrict access to sensitive information and network traffic to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2011-1509

Produtos afetados

Manageengine Servicedesk Plus

Referências · 6

• http://securityreason.com/securityalert/8385 · Nota
• http://coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69841 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1509 · Nota de Segurança
• http://securityfocus.com/bid/49636 · Nota
• http://securityfocus.com/archive/1/519652/100/0/threaded · Nota