CVE-2011-2757

2022-10-0316:15:17

CWE-22

[email protected]

web.nvd.nist.gov

cve-2011-2757

directory traversal

filedownload.jsp

manageengine servicedesk plus

remote attackers

arbitrary files

security vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

82.1%

JSON

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a … (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue.

Affected configurations

NVD

Node

manageengineservicedesk_plusRange≤8.0.0.12

manageengineservicedesk_plusMatch7.0.0

manageengineservicedesk_plusMatch7.6

manageengineservicedesk_plusMatch8.0

CPENameOperatorVersion
manageengine:servicedesk_plusmanageengine servicedesk plusle8.0.0.12
manageengine:servicedesk_plusmanageengine servicedesk pluseq7.0.0
manageengine:servicedesk_plusmanageengine servicedesk pluseq7.6
manageengine:servicedesk_plusmanageengine servicedesk pluseq8.0

CPE	Name	Operator	Version
manageengine:servicedesk_plus	manageengine servicedesk plus	le	8.0.0.12
manageengine:servicedesk_plus	manageengine servicedesk plus	eq	7.0.0
manageengine:servicedesk_plus	manageengine servicedesk plus	eq	7.6
manageengine:servicedesk_plus	manageengine servicedesk plus	eq	8.0