CVE-2019-10008
Last modified
CVE-2019-10008 is a vulnerability of currently unknown severity. Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.. EPSS estimates a 19.73% chance of exploitation in the next 30 days.
Description
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | Servicedesk Plus | 9.3 |
References
- https://www.exploit-db.com/exploits/46659Exploit, Third Party Advisory, VDB Entry
- https://www.manageengine.com/products/service-desk/readme.htmlRelease Notes, Vendor Advisory
- https://www.exploit-db.com/exploits/46659Exploit, Third Party Advisory, VDB Entry
- https://www.manageengine.com/products/service-desk/readme.htmlRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10008?
How severe is CVE-2019-10008?
How do I fix CVE-2019-10008?
Are you affected by CVE-2019-10008?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST