← Volver a CVEs
CVE-2019-8394
MEDIUMCISA KEV6.5
Descripcion
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
Detalles CVE
Puntuacion CVSS v3.16.5
SeveridadMEDIUM
Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Vector de ataqueNETWORK
ComplejidadLOW
Privilegios requeridosLOW
Interaccion usuarioNONE
Publicado2/17/2019
Ultima modificacion11/7/2025
Fuentekev
Avistamientos honeypot0
CISA KEV
VendedorZoho
ProductoManageEngine
Nombre vulnerabilidadZoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
Fecha inclusion KEV2021-11-03
Fecha limite remediacion2022-05-03
Uso en ransomwareUnknown
Productos afectados
zohocorp:manageengine_servicedesk_plus
Debilidades (CWE)
CWE-434CWE-434
Referencias
http://www.securityfocus.com/bid/107129(cve@mitre.org)
https://www.exploit-db.com/exploits/46413/(cve@mitre.org)
http://www.securityfocus.com/bid/107129(af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/46413/(af854a3a-2127-422b-91ae-364da2661108)
https://www.manageengine.com/products/service-desk/readme.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8394(134c704f-9b21-4f2e-91b3-4a467353bcc0)
Correlaciones IOC
Sin correlaciones registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.