CVE-2019-8395

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-02-17 · updated 2026-06-17
Weakness: CWE-22

Description

An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.

Affected products

ManageEngine ServiceDesk Plus: before 10.0 — fixed in 10.0

How to fix

Upgrade to a fixed version: ManageEngine ServiceDesk Plus 10.0. Check the vendor advisory for mitigations.

References

https://www.manageengine.com/products/service-desk/readme.html
https://www.manageengine.com/products/service-desk/readme.html

Get alerted when CVE-2019-8395 or the next vulnerability affects your stack