CVE-2018-7248

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-05-11 · updated 2026-06-17

Description

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it does not.

Affected products

ManageEngine ServiceDesk Plus: 9.3-9317

References

http://www.securityfocus.com/bid/104287
https://gitlab.com/e-sterling/cve-2018-7248
https://medium.com/%40esterling_/cve-2018-7248-enumerating-active-directory-users-via-unauthenticated-manageengine-servicedesk-a1eda2942eb0
http://www.securityfocus.com/bid/104287
https://gitlab.com/e-sterling/cve-2018-7248
https://medium.com/%40esterling_/cve-2018-7248-enumerating-active-directory-users-via-unauthenticated-manageengine-servicedesk-a1eda2942eb0

Get alerted when CVE-2018-7248 or the next vulnerability affects your stack