search menu icon-carat-right cmu-wordmark

CERT Coordination Center

ManageEngine ServiceDesk directory traversal vulnerability

Vulnerability Note VU#543310

Original Release Date: 2011-06-27 | Last Revised: 2011-06-27

Overview

ManageEngine ServiceDesk contains a directory traversal vulnerability which may allow a remote, unauthenticated attacker to obtain sensitive information.

Description

ManageEngine ServiceDesk Plus 8.0, and possibly prior versions, contains a directory traversal vulnerability in the FileDownload.jsp page caused by an input validation error when handling requests. Additionally, ServiceDesk Plus 8.0 fails to verify that requests to the FileDownload.jsp page originate from an authenticated user. An unauthenticated attacker can exploit these vulnerabilities via directory traversal specifiers sent in a specially crafted request to the FileDownload.jsp page.

Impact

A remote unauthenticated attacker could obtain sensitive information.

Solution

Apply an Update

ManageEngine recommends users update to ManageEngine Service Desk Build 8012 or later.

Vendor Information

543310
 
Affected   Unknown   Unaffected

Zoho

Notified:  May 16, 2011 Updated:  June 22, 2011

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.manageengine.com/products/service-desk/service-packs.html


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

Thanks to Keith Lee Yong Ming for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs: None
Severity Metric: 2.43
Date Public: 2011-06-21
Date First Published: 2011-06-27
Date Last Updated: 2011-06-27 13:40 UTC
Document Revision: 10

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.