PT-2019-13952 · Zoho · Zoho Manageengine Servicedesk Plus

Published 2019-08-21 · Updated 2024-08-05 · CVE-2019-15045

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 10

Description The issue allows user enumeration through the AjaxDomainServlet. The vendor considers this as intended functionality.

Recommendations For Zoho ManageEngine ServiceDesk Plus version 10, consider restricting access to the AjaxDomainServlet to minimize the risk of user enumeration.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-15045

Affected Products

Zoho Manageengine Servicedesk Plus

References · 7

• 🔥 http://packetstormsecurity.com/files/154183/Zoho-Corporation-ManageEngine-ServiceDesk-Plus-Information-Disclosure.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2019/Aug/17 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15045 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15045 · Vendor Advisory
• https://manageengine.com/products/service-desk/readme.html · Vendor Advisory
• https://t.me/cvenotify/83691 · Telegram Post
• https://t.me/cvenotify/89094 · Telegram Post