PT-2025-22455 · Zohocorp · Supportcenter Plus+1

Esther · Published 2025-04-10 · Updated 2025-05-22 · CVE-2025-3444

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920

Description The issue concerns an authenticated Local File Inclusion (LFI) in the Admin module of the software, specifically where help card content is loaded.

Recommendations For versions below 14920, update to version 14920 or later to resolve the issue. As a temporary workaround, consider restricting access to the Admin module until a patch is available. Avoid using the vulnerable functionality in the Admin module where help card content is loaded until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-09772

CVE-2025-3444

Affected Products

Manageengine Servicedesk Plus

Supportcenter Plus

References · 6

• https://bdu.fstec.ru/vul/2025-09772 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3444 · Vendor Advisory
• https://manageengine.com/products/service-desk-msp/cve-2025-3444.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3444 · Security Note
• https://twitter.com/CVEnew/status/1925505329766256947 · Twitter Post
• https://vuldb.com/?id.309978 · Note