6.5

CVE-2025-3444

Local File Inclusion

Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 14.9 Update 14900
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 14.9 Update 14910
Zohocorp ≫ Manageengine Supportcenter Plus Version 14.9 Update 14900
Zohocorp ≫ Manageengine Supportcenter Plus Version 14.9 Update 14910
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.43% 0.707
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
0fc0942c-577d-436f-ae8e-945763c79b02 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://www.manageengine.com/products/service-desk-msp/cve-2025-3444.html
Vendor Advisory