PT-2019-12719 · Zoho · Zoho Manageengine Servicedesk Plus

Published 2019-05-21 · Updated 2023-03-01 · CVE-2019-12252

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 10.6

Description The issue allows users with the lowest privileges, such as guest users, to view arbitrary posts by manipulating the URL. This can be achieved by appending the post number to the "SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id=" substring in the URL.

Recommendations For Zoho ManageEngine ServiceDesk Plus versions prior to 10.6, update to version 10.6 or later to resolve the issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2019-12252

Affected Products

Zoho Manageengine Servicedesk Plus

References · 7

• 🔥 https://exploit-db.com/exploits/46894 · Exploit
• 🔥❌ https://github.com/tuyenhva/CVE-2019-12252 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2019-12252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12252 · Security Note
• https://manageengine.com/products/service-desk/readme.html · Note
• http://packetstormsecurity.com/files/153029/Zoho-ManageEngine-ServiceDesk-Plus-Privilege-Escalation.html · Note
• http://securityfocus.com/bid/108456 · Note