CVE-2017-11512: Path Traversal
Published Nov 8, 2017
·Updated
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.
Affected Software
1 affected component
ManageEngine ServiceDesk=9.3.9328
Event History
Nov 8, 2017
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2017-11512.
2
What is the severity of CVE-2017-11512?
CVE-2017-11512 has a severity score of 7.5, classified as high.
3
What is the affected software?
The affected software is ManageEngine ServiceDesk version 9.3.9328.
4
How can an attacker exploit CVE-2017-11512?
An unauthenticated remote attacker can exploit CVE-2017-11512 to download arbitrary files.
5
Are there any known references related to CVE-2017-11512?
Yes, there are references available at http://www.securityfocus.com/bid/101789 and https://www.tenable.com/security/research/tra-2017-31.