CVE-2017-11512

7.5 highEPSS 80%

High (7.5) in manageengine servicedesk. EPSS 80% chance of exploitation in the next 30 days.

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 80% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2017-11-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

manageengine:servicedesk

References

http://www.securityfocus.com/bid/101789
https://www.tenable.com/security/research/tra-2017-31
http://www.securityfocus.com/bid/101789
https://www.tenable.com/security/research/tra-2017-31

Check your stack JSON