CVE-2011-2757

ManageEngine ServiceDesk 8.0.0.12 - Database Disclosure

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue.

Vulnerabilidad de salto de directorio en FileDownload.jsp en ManageEngine ServiceDesk Plus v8.0.0.12 y anteriores permite a atacantes remotos leer y ejecutar ficheros a su elección mediante secuencias .. (punto punto) en el parametro file.
NOTA: puede solaparse con el problema US-CERT VU # 543310.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-06-23 First Exploit
2011-07-17 CVE Reserved
2011-07-17 CVE Published
2024-09-16 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC
https://www.exploit-db.com/exploits/17503	2011-07-07
https://www.exploit-db.com/exploits/17437	2011-06-23
https://www.exploit-db.com/exploits/17442	2011-06-23
http://www.exploit-db.com/exploits/17503	2024-09-16

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Manageengine Search vendor "Manageengine"		Servicedesk Plus Search vendor "Manageengine" for product "Servicedesk Plus"				<= 8.0.0.12 Search vendor "Manageengine" for product "Servicedesk Plus" and version " <= 8.0.0.12"		-		Affected
Manageengine Search vendor "Manageengine"		Servicedesk Plus Search vendor "Manageengine" for product "Servicedesk Plus"				7.0.0 Search vendor "Manageengine" for product "Servicedesk Plus" and version "7.0.0"		-		Affected
Manageengine Search vendor "Manageengine"		Servicedesk Plus Search vendor "Manageengine" for product "Servicedesk Plus"				7.6 Search vendor "Manageengine" for product "Servicedesk Plus" and version "7.6"		-		Affected
Manageengine Search vendor "Manageengine"		Servicedesk Plus Search vendor "Manageengine" for product "Servicedesk Plus"				8.0 Search vendor "Manageengine" for product "Servicedesk Plus" and version "8.0"		-		Affected