Описание
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account.
Ссылки
- ExploitThird Party AdvisoryVDB Entry
- ExploitThird Party Advisory
- ExploitThird Party AdvisoryVDB Entry
- ExploitThird Party AdvisoryVDB Entry
- ExploitThird Party Advisory
- ExploitThird Party AdvisoryVDB Entry
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:9.3:*:*:*:*:*:*:*
EPSS
Процентиль: 94%
0.13704
Средний
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-287
Связанные уязвимости
CVSS3: 4.3
github
больше 3 лет назад
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account.
EPSS
Процентиль: 94%
0.13704
Средний
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-287