PT-2019-13952 · Zoho · Zoho Manageengine Servicedesk Plus

CVE-2019-15045 · Publicado 2019-08-21 · Atualizado 2024-08-05

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 10

Description The issue allows user enumeration through the AjaxDomainServlet. The vendor considers this as intended functionality.

Recommendations For Zoho ManageEngine ServiceDesk Plus version 10, consider restricting access to the AjaxDomainServlet to minimize the risk of user enumeration.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2019-15045

Produtos afetados

Zoho Manageengine Servicedesk Plus

Referências · 7

• 🔥 http://packetstormsecurity.com/files/154183/Zoho-Corporation-ManageEngine-ServiceDesk-Plus-Information-Disclosure.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2019/Aug/17 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15045 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15045 · Aviso do Fabricante
• https://manageengine.com/products/service-desk/readme.html · Aviso do Fabricante
• https://t.me/cvenotify/83691 · Publicação no Telegram
• https://t.me/cvenotify/89094 · Publicação no Telegram