The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the…
Zoho · ManageEngine ServiceDesk
The ManageEngine ServiceDesk product from Zoho contains a path traversal flaw in the handling of the name parameter for its download-snapshot URL, where pathnames are not properly restricted. An unauthenticated remote attacker who can reach the affected endpoint can exploit this to download arbitrary files, with no authentication or user interaction required.
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 4 years after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+4 yrs
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.