CVE-2019-8395

CRITICAL

An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.

Published: Feb 17, 2019 Modified: Jun 17, 2026

CWE-22 CWE-706

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
zohocorp	manageengine_servicedesk_plus	* < 10.0

GitHub Security Advisory GHSA-xfcc-h2cc-43qv

An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk...

References (2)

https://www.manageengine.com/products/service-desk/readme.html Vendor Advisory
https://www.manageengine.com/products/service-desk/readme.html Vendor Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 7.07%

Top 6% most likely to be exploited

Threat Score 41.3 / 100

Data Sources

NVD EPSS GitHub