CVE-2015-1480: Infoleak

Q: What is the severity of CVE-2015-1480?

CVE-2015-1480 is rated as a medium severity vulnerability due to its impact on sensitive ticket information exposure.

Q: How do I fix CVE-2015-1480?

To fix CVE-2015-1480, upgrade to ManageEngine ServiceDesk Plus version 9.0 build 9031 or later.

Q: Who is affected by CVE-2015-1480?

CVE-2015-1480 affects remote authenticated users of ManageEngine ServiceDesk Plus versions prior to 9.0 build 9031.

Q: What type of vulnerability is CVE-2015-1480?

CVE-2015-1480 is a privilege escalation vulnerability that allows unauthorized access to sensitive data.

Q: Can CVE-2015-1480 be exploited remotely?

Yes, CVE-2015-1480 can be exploited remotely by authenticated users to access sensitive ticket data.

Published Feb 4, 2015

Updated

ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to servlet/AJaxServlet or a direct request to (2) swf/flashreport.swf, (3) reports/flash/details.jsp, or (4) reports/CreateReportTable.jsp.

Affected Software

1 affected component

ManageEngine ServiceDesk Plus<=9.0

Event History

Feb 4, 2015

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1480?

CVE-2015-1480 is rated as a medium severity vulnerability due to its impact on sensitive ticket information exposure.

How do I fix CVE-2015-1480?

To fix CVE-2015-1480, upgrade to ManageEngine ServiceDesk Plus version 9.0 build 9031 or later.

Who is affected by CVE-2015-1480?

CVE-2015-1480 affects remote authenticated users of ManageEngine ServiceDesk Plus versions prior to 9.0 build 9031.

What type of vulnerability is CVE-2015-1480?

CVE-2015-1480 is a privilege escalation vulnerability that allows unauthorized access to sensitive data.

Can CVE-2015-1480 be exploited remotely?