Multiple vulnerabilities in Zoho ManageEngine ServiceDesk Plus
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | N/A |
| CWE-ID | CWE-319 CWE-200 CWE-310 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Zoho ManageEngine ServiceDesk Plus Web applications / Remote management & hosting panels |
| Vendor | Zoho Corporation |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Cleartext transmission of sensitive information
EUVDB-ID: #VU28132
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: N/A
CWE-ID:
CWE-319 - Cleartext Transmission of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to HTTP to HTTPS redirection is not done for a particular URL in the application login page. A remote attacker with ability to intercept network traffic can gain access to sensitive data.
MitigationInstall updates from vendor's website.
Vulnerable software versionsZoho ManageEngine ServiceDesk Plus: 11.1 build 11100 - 11.1 build 11112
External linkshttp://www.manageengine.com/products/service-desk/on-premises/readme.html?112233
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Information disclosure
EUVDB-ID: #VU28133
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: N/A
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system, such as Clipboard Data.
MitigationInstall updates from vendor's website.
Vulnerable software versionsZoho ManageEngine ServiceDesk Plus: 11.1 build 11100 - 11.1 build 11112
External linkshttp://www.manageengine.com/products/service-desk/on-premises/readme.html?112233
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) BREACH attack
EUVDB-ID: #VU28134
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: N/A
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a BREACH attack issue. A remote attacker can recover the headers of an HTTP request and gain unauthorized access to sensitive information on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsZoho ManageEngine ServiceDesk Plus: 11.1 build 11100 - 11.1 build 11112
External linkshttp://www.manageengine.com/products/service-desk/on-premises/readme.html?112233
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
