CVE-2016-4889
HighSummary
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to leverage failure to restrict access to unknown functions, potentially leading to unspecified impact.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive functions, which could result in data loss or privacy breaches.
Recommendation
It is recommended to upgrade to version 9.0 or later to mitigate this vulnerability and review access policies for guest users.
Other vulnerabilities in ZOHO ManageEngine ServiceDesk Plus
See all- CVE-2021-44077CriticalActively exploited
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
- CVE-2021-37415CriticalActively exploited
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
Original NVD description (English source)
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions.