N/A

Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.

N/A

N/A

ZOHO ManageEngine ServiceDesk Plus 授权问题漏洞

ZOHO ManageEngine ServiceDesk Plus（SDP）是美国卓豪（ZOHO）公司的一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。 ZOHO ManageEngine SDP 9.3版本中存在安全漏洞。攻击者可利用该漏洞枚举用户。

N/A

N/A