Zoho · ManageEngine

CVE-2019-8394

Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability

Exploited in attacks High 7.5 Attack chance: 63%

What it is

Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.

CISA: Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: February 17, 2019
Severity: High 7.5 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 63% in the top 0.8% of all known vulnerabilities
Weakness: CWE-434
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Zoho

Added	Vulnerability	Product	Severity	Attack chance
Mar 7, 2023	ADSelfService Plus Remote Code ExecutionCVE-2022-28810	ManageEngine	Medium 6.8	71%
Jan 23, 2023	Multiple Products Remote Code ExecutionCVE-2022-47966used by ransomware	ManageEngine	Critical 9.8	99.8%
Sep 22, 2022	Multiple Products Remote Code ExecutionCVE-2022-35405	ManageEngine	Critical 9.8	99.9%
Nov 3, 2021	Desktop Central File UploadCVE-2020-10189	ManageEngine	Critical 9.8	99.9%
Nov 3, 2021	ADSelfService Plus Authentication BypassCVE-2021-40539used by ransomware	ManageEngine	Critical 9.8	99%
Dec 10, 2021	Authentication BypassCVE-2021-44515	Desktop Central	Critical 9.8	99.9%
Dec 1, 2021	ManageEngine ServiceDesk Authentication BypassCVE-2021-37415	ManageEngine ServiceDesk Plus (SDP)	Critical 9.8	99.8%
Dec 1, 2021	ManageEngine ServiceDesk Plus Remote Code ExecutionCVE-2021-44077	ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus	Critical 9.8	93%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.