CVE-2016-4890

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-254

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN72559412/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000171.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/93216Third Party Advisory, VDB Entry
https://www.manageengine.com/products/service-desk/readme-9.2.html
http://jvn.jp/en/jp/JVN72559412/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000171.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/93216Third Party Advisory, VDB Entry
https://www.manageengine.com/products/service-desk/readme-9.2.html

Timeline

Published: Apr 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-48918.8Cross-site request forgery (CSRF) vulnerability in SetsucoCMS all versions allows remote attackers to hijack the authentication of an admini CVE-2016-48926.1Cross-site scripting vulnerability in SetsucoCMS all versions allows remote attackers to inject arbitrary web script or HTML via unspecified CVE-2016-48938.8SQL injection vulnerability in the SetsucoCMS all versions allows remote authenticated attackers to execute arbitrary SQL commands via unspe CVE-2016-48945.3SetsucoCMS all versions allows remote attackers to cause a denial of service via unspecified vectors.CVE-2016-48958.8SetsucoCMS all versions allows remote authenticated attackers to conduct code injection attacks via unspecified vectors.CVE-2016-48966.5SetsucoCMS all versions does not properly manage sessions, which allows remote attackers to disclose or alter unauthorized information via u CVE-2016-48976.1Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/search.cgi in Usermin befo CVE-2016-48989.8The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspec CVE-2016-48999.8The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspec CVE-2016-49007.8Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan ho CVE-2016-49017.8Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan CVE-2016-49027.8Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)"