CVE-2019-12252

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/153029/Zoho-ManageEngine-ServiceDesk-Plus-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/108456Broken Link
https://github.com/tuyenhva/CVE-2019-12252Third Party Advisory
https://www.manageengine.com/products/service-desk/readme.htmlRelease Notes
http://packetstormsecurity.com/files/153029/Zoho-ManageEngine-ServiceDesk-Plus-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/108456Broken Link
https://github.com/tuyenhva/CVE-2019-12252Third Party Advisory
https://www.manageengine.com/products/service-desk/readme.htmlRelease Notes

Timeline

Published: May 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-122536.5my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&delete_posting.CVE-2019-122549.8In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is r CVE-2019-122559.8Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 CVE-2019-122569.8Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the CVE-2019-122578.8Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overfl CVE-2019-122587.5Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection CVE-2019-122597.5Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerabil CVE-2019-12269.8A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated atta CVE-2019-122609.8Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgen CVE-2019-122619.8Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability CVE-2019-122629.8Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security vulnerability: Handlin CVE-2019-122638.1Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Ur