Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:MANAGENGINE-POL-BYPASS |
|---|---|
Severity |
Major |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
ManageEngine ServiceDesk Plus User Privileges Bypass |
Release Date |
2015/03/02 |
Update Number |
2471 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: ManageEngine ServiceDesk Plus User Privileges Bypass
This signature detects attempts to exploit a known vulnerability against ManageEngine ServiceDesk Plus. Successful exploitation could lead to unauthorized access.
Extended Description
ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to servlet/AJaxServlet or a direct request to (2) swf/flashreport.swf, (3) reports/flash/details.jsp, or (4) reports/CreateReportTable.jsp.
Affected Products
- Manageengine servicedesk_plus 9.0
References
- BugTraq: 72302
- CVE: CVE-2015-1480