CVE-2016-1594

published 2016-04-22

CVE-2016-1594: Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated…

medium 6.5 CVSS 3.0

AV N AC L PR L UI N S U C H I N A N

EXPLOIT

Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via a (1) downloadLogFiles or (2) downloadFile action.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
novell	service_desk	<= 7.1	—

CWE-200