CVE-2019-12252 - In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring

Back Back to CVE browser

MEDIUM

In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring

Published May 21, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 8.21%

Description

In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (5)

http://packetstormsecurity.com/files/153029/Zoho-ManageEngine-ServiceDesk-Plus-Privilege-Escalation.html
x_refsource_MISCThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/108456
vdb-entryx_refsource_BIDBroken Link
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3894
Advisory
https://github.com/tuyenhva/CVE-2019-12252
x_refsource_MISCThird Party Advisory
https://www.manageengine.com/products/service-desk/readme.html
x_refsource_MISCRelease Notes

Link	Providers	Tags
http://packetstormsecurity.com/files/153029/Zoho-ManageEngine-ServiceDesk-Plus-Privilege-Escalation.html		x_refsource_MISCThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/108456		vdb-entryx_refsource_BIDBroken Link
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3894		Advisory
https://github.com/tuyenhva/CVE-2019-12252		x_refsource_MISCThird Party Advisory
https://www.manageengine.com/products/service-desk/readme.html		x_refsource_MISCRelease Notes