← Back to CVEs
CVE-2019-8394
MEDIUMCISA KEV6.5
Description
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
CVE Details
CVSS v3.1 Score6.5
SeverityMEDIUM
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
Published2/17/2019
Last Modified11/7/2025
Sourcekev
Honeypot Sightings0
CISA KEV
VendorZoho
ProductManageEngine
Vulnerability NameZoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
KEV Date Added2021-11-03
Remediation Due Date2022-05-03
Ransomware UseUnknown
Affected Products
zohocorp:manageengine_servicedesk_plus
Weaknesses (CWE)
CWE-434CWE-434
References
http://www.securityfocus.com/bid/107129(cve@mitre.org)
https://www.exploit-db.com/exploits/46413/(cve@mitre.org)
http://www.securityfocus.com/bid/107129(af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/46413/(af854a3a-2127-422b-91ae-364da2661108)
https://www.manageengine.com/products/service-desk/readme.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8394(134c704f-9b21-4f2e-91b3-4a467353bcc0)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.