CVE-2011-2757

EPSS 39.4%

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue.

Affected products

n/a · n/a

public PoCs found — 4

cve_referencewww.exploit-db.com/exploits/17503/unverified exploitdbwww.exploit-db.com/exploits/17503unverified exploitdbwww.exploit-db.com/exploits/17437unverified exploitdbwww.exploit-db.com/exploits/17442unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://www.exploit-db.com/exploits/17503/