Actively exploited in the wild
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
Zoho - ManageEngine · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-8394
MediumCVSS 6.5KEVSummary
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
Risk Assessment
An attacker could upload malicious files to the server, potentially leading to code execution or system compromise.
Recommendation
Update Zoho ManageEngine ServiceDesk Plus to version 10.0 build 10012 or later.
Other vulnerabilities in Zoho ManageEngine ServiceDesk Plus
See all- CVE-2016-4889High
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to leverage failure to restrict access to unknown functions, potentially leading to unspecified impact.
- CVE-2021-44077CriticalActively exploited
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
- CVE-2021-37415CriticalActively exploited
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
Original NVD description (English source)
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.