ManageEngine ServiceDesk vulnerabilities

2 CVEs affecting ManageEngine ServiceDesk, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-11512, published 2017-11-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-11512, published 2017-11-08. High severity, CVSS 7.5. EPSS: 79.6% chance of exploitation in the next 30 days. The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An…
CVE-2017-11511, published 2017-11-08. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An…