Servicedesk Plus
Vendor:
First CVE: Mar 12, 2008 · Active for 18 years
10
Total CVEs
More Total CVEs than 88% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
5.6
Avg CVSS
Higher Avg CVSS than 16% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Servicedesk Plus over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 12, 2008
18 years ago
Most Recent CVE
Aug 28, 2017
3,254 days ago
CVE Severity & Scoring
Servicedesk Plus10 CVEs
80%
20%
All CVEs352,719 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network3 (30.0%)
Unknown7 (70.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (30.0%)
High0 (0.0%)
Unknown7 (70.0%)
User Interaction
None2 (20.0%)
Unknown7 (70.0%)
Required1 (10.0%)
Privileges Required
Low2 (20.0%)
High0 (0.0%)
None1 (10.0%)
Unknown7 (70.0%)
Top CVEs
Signals from CVEs in this product scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-5301HIGH Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4. | Aug 28, 2017 | 8.8 | 84 | NO | YES |
CVE-2011-2757MEDIUM Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in th | Jul 17, 2011 | 5.0 | 55 | NO | YES |
CVE-2011-2755MEDIUM Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors | Jul 17, 2011 | 5.0 | 42 | NO | YES |
CVE-2014-5302HIGH Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote authen | Aug 28, 2017 | 8.8 | 31 | NO | NO |
CVE-2012-2585MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body wi | Aug 12, 2012 | 4.3 | 24 | NO | YES |
CVE-2015-1480MEDIUM ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to servlet/AJ | Feb 4, 2015 | 4.0 | 22 | NO | YES |
CVE-2011-2756MEDIUM FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via u | Jul 17, 2011 | 5.0 | 19 | NO | NO |
CVE-2008-1299MEDIUM Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script o | Mar 12, 2008 | 6.1 | 19 | NO | NO |
CVE-2011-1509MEDIUM The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier | Sep 20, 2011 | 5.0 | 17 | NO | NO |
CVE-2011-1510MEDIUM Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via | Sep 20, 2011 | 4.3 | 16 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (10 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
2 CVEs
20.0% of CVEs· 97th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
5 CVEs
50.0% of CVEs· 91st percentile
Social Chatter
Signals from CVEs in this product scope (10 CVEs).
Media Mentions
Signals from CVEs in this product scope (10 CVEs).
Top CNAs Publishing CVEs For Servicedesk Plus
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 8.1 | 1 | 4.3 | 1.4% | 0 | 1 |
| 8.0 | 4 | 5.0 | 18.3% | 0 | 2 |
| 7.6 | 1 | 5.0 | 39.4% | 0 | 1 |
| 7.0.0 | 2 | 5.5 | 20.1% | 0 | 1 |