CVE-2017-11512: ManageEngine ServiceDesk

High severity, CVSS 7.5. EPSS: 79.6% chance of exploitation in the next 30 days.

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.

Affected products

• ManageEngine ServiceDesk: version 9.3.9328 only

Published 2017-11-08. Last modified 2026-06-17.