VulnerabilityModified
CVE-2011-2757
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a ..
MEDIUM 5.0EPSS 39.4%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 39.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 39.37% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- manageengine/servicedesk plus
- Source
- cve@mitre.org
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.