CVE-2017-11511

2017-11-0800:00:00

CWE-22

tenable

www.cve.org

0.332 Low

EPSS

Percentile

97.1%

JSON

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.

CNA Affected

[
  {
    "product": "ManageEngine ServiceDesk",
    "vendor": "Zoho",
    "versions": [
      {
        "status": "affected",
        "version": "9.3.9328"
      }
    ]
  }
]