CVE-2017-11512

Affected product: ManageEngine ServiceDesk 9.3.9328. Vulnerability: Arbitrary file retrieval/download due to improper restrictions on the pathname in the name parameter of the download-snapshot path. Impact: Unauthenticated remote attacker can download arbitrary files from the server. Root cause:...

CVE-2017-11511

The ManageEngine ServiceDesk (version 9.3.9328 ) is vulnerable to an arbitrary file download flaw. The root cause is the improper restriction of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can exploit this vulnerability to download arb...