Lucene search

MitreCVE-2015-1480

HistoryFeb 04, 2015 - 4:59 p.m.

CVE-2015-1480

2015-02-0416:59:09

CWE-200

mitre

web.nvd.nist.gov

zoho

manageengine

servicedesk plus

sdp

cve-2015-1480

vulnerability

information security

ticket information

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.756

Percentile

98.2%

JSON

ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to servlet/AJaxServlet or a direct request to (2) swf/flashreport.swf, (3) reports/flash/details.jsp, or (4) reports/CreateReportTable.jsp.

Affected configurations

Nvd

Node

manageengineservicedesk_plusRange≤9.0

VendorProductVersionCPE
manageengineservicedesk_plus*cpe:2.3:a:manageengine:servicedesk_plus:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
manageengine	servicedesk_plus	*	cpe:2.3:a:manageengine:servicedesk_plus::::::::

References

osvdb.org/show/osvdb/117499

packetstormsecurity.com/files/130081/ManageEngine-ServiceDesk-Plus-9.0-Privilege-Escalation.html

www.exploit-db.com/exploits/35904

www.manageengine.com/products/service-desk/readme-9.0.html

www.rewterz.com/vulnerabilities/manageengine-servicedesk-plus-user-privileges-management-vulnerability

www.securityfocus.com/archive/1/534538/100/0/threaded

www.securityfocus.com/bid/72302

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.756

Percentile

98.2%

JSON

Related for CVE-2015-1480