Vulnerability Details CVE-2017-11511
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.041
EPSS Ranking 88.1%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
Products affected by CVE-2017-11511
-
cpe:2.3:a:manageengine:servicedesk:9.3.9328