[ CVE-2019-8394 · Published 17 Feb 2019 ]

Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability

Exploited · CISA KEV CVSS 6.5 EPSS 63%No fix listed yet

[ Why it matters ]Priority signals

Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
EPSS: 63% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.

CISA: Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

www.securityfocus.com/bid/107129Third Party AdvisoryVDB Entry
www.exploit-db.com/exploits/46413ExploitThird Party AdvisoryVDB Entry
www.manageengine.com/products/service-desk/readme.htmlRelease NotesVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource