CVE-2019-15046 — Improper Authentication in Manageengine Servicedesk Plus

CWE-287 — Improper Authentication CWE-200 — Sensitive Information Exposure3 documents3 sources

Severity

7.5HIGHNVD

EPSS

5.0%

top 10.30%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Servicedesk Plus

Timeline

PublishedAug 14

Latest updateMay 24

Description

Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDzohocorp/manageengine_servicedesk_plus10 — 10509

🔴Vulnerability Details

GHSA

GHSA-cwx9-fqr7-6wj5: Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, ak↗2022-05-24

▶

CVEList

CVE-2019-15046: Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, ak↗2019-08-14

▶