Incorrect regular expression in Zoho ManageEngine ServiceDesk Plus and Zoho ManageEngine ServiceDesk Plus MSP - CVE-2025-8309

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU114229

Incorrect regular expression in Zoho ManageEngine ServiceDesk Plus and Zoho ManageEngine ServiceDesk Plus MSP - CVE-2025-8309

Published: August 19, 2025


Vulnerability identifier: #VU114229
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-8309
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to take over an arbitrary account within the application.

The vulnerability exists due to overly permissive regular expression (regex) rules in URL mapping when matching servlet paths using wildcards. A remote authenticated user can take control of an arbitrary user account, including administrator accounts. 


Affected software

Zoho ManageEngine ServiceDesk Plus
ManageEngine AssetExplorer
Zoho ManageEngine ServiceDesk Plus MSP
Zoho ManageEngine SupportCenter Plus

How to mitigate CVE-2025-8309

Install updates from vendor's website.

Zoho ManageEngine ServiceDesk Plus - update to 15.1 15110
Zoho ManageEngine ServiceDesk Plus MSP - update to 14940
ManageEngine AssetExplorer - update to 7710
Zoho ManageEngine SupportCenter Plus - update to 14940

External References

Related Security Bulletins