CVE-2018-7248

CVE-2018-7248 is a medium-severity vulnerability affecting Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317, allowing unauthenticated users to enumerate valid domain user accounts. By sending a username to a specific API endpoint, an attacker can determine if an account exists based on the response. The attack vector is network-based with low complexity, resulting in a low impact on confidentiality by revealing account existence, but no impact on integrity or availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.