Vulnerability Description
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | Servicedesk Plus | 9.3 |
Related Weaknesses (CWE)
References
- https://www.exploit-db.com/exploits/46659ExploitThird Party AdvisoryVDB Entry
- https://www.manageengine.com/products/service-desk/readme.htmlRelease NotesVendor Advisory
- https://www.exploit-db.com/exploits/46659ExploitThird Party AdvisoryVDB Entry
- https://www.manageengine.com/products/service-desk/readme.htmlRelease NotesVendor Advisory
FAQ
What is CVE-2019-10008?
CVE-2019-10008 is a vulnerability with a CVSS score of 8.8 (HIGH). Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the g...
How severe is CVE-2019-10008?
CVE-2019-10008 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10008?
Check the references section above for vendor advisories and patch information. Affected products include: Zohocorp Servicedesk Plus.