PT-2011-3176 · Zoho · Manageengine Servicedesk Plus

Matias Blanco · Published 2011-09-20 · Updated 2018-10-09 · CVE-2011-1509

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus (SDP) versions 8012 and earlier

Description The issue concerns the encryption of passwords in cookies. It is related to the encryptPassword function in Login.js, which uses a Caesar cipher for encryption. This makes it easier for remote attackers to obtain sensitive information by sniffing the network.

Recommendations For ManageEngine ServiceDesk Plus (SDP) versions 8012 and earlier, as a temporary workaround, consider disabling the encryptPassword function in Login.js until a proper encryption method is implemented. Restrict access to sensitive information and network traffic to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2011-1509

Affected Products

Manageengine Servicedesk Plus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-1509 · Security Note
• http://securityreason.com/securityalert/8385 · Note
• http://coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69841 · Note
• http://securityfocus.com/bid/49636 · Note
• http://securityfocus.com/archive/1/519652/100/0/threaded · Note