{"id":"CVE-2017-11512","published":"2017-11-08T22:00:00Z","modified":"2024-09-16T17:02:50Z","title":"The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the…","vendor":"Zoho","product":"ManageEngine ServiceDesk","tier":"core","eol":null,"affectedVersions":[{"vendor":"Zoho","product":"ManageEngine ServiceDesk","versions":["9.3.9328"]}],"description":{"text":"The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.","provenance":"source","from":"CVE.org"},"summary":{"text":"The ManageEngine ServiceDesk product from Zoho contains a path traversal flaw in the handling of the name parameter for its download-snapshot URL, where pathnames are not properly restricted. An unauthenticated remote attacker who can reach the affected endpoint can exploit this to download arbitrary files, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:19:10Z"},"cvss":null,"epss":{"score":0.79604,"percentile":0.99603,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-01-12","exploitedFirstSeen":"2022-01-12","ransomware":false,"evidence":[{"url":"https://blog.checkpoint.com/security/december-2021s-most-wanted-malware-trickbot-emotet-and-the-log4j-plague/","date":"2022-01-12"},{"url":"https://blog.checkpoint.com/security/april-2022s-most-wanted-malware-a-shake-up-in-the-index-but-emotet-is-still-on-top/","date":"2022-05-11"},{"url":"https://blog.checkpoint.com/security/april-2024s-most-wanted-malware-surge-in-androxgh0st-attacks-and-the-decline-of-lockbit3/","date":"2024-05-09"},{"url":"https://blog.checkpoint.com/research/may-2024s-most-wanted-malware-phorpiex-botnet-unleashes-phishing-frenzy-while-lockbit3-dominates-once-again","date":"2024-06-10"},{"url":"https://blog.checkpoint.com/research/july-2024s-most-wanted-malware-remcos-and-ransomhub-run-rampant/","date":"2024-08-12"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024","date":"2024-09-19"},{"url":"https://blog.checkpoint.com/research/september-2024s-most-wanted-malware-notable-ai-driven-techniques-and-persistent-ransomhub-threats/","date":"2024-10-11"},{"url":"https://blog.checkpoint.com/security/october-2024s-most-wanted-malware-infostealers-surge-as-cyber-criminals-leverage-innovative-attack-vectors/","date":"2024-11-11"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/botpoke-scanner-switches-ip","date":"2024-11-25"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/continued-scanning-for-cve-2023-1389","date":"2025-01-21"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2017-31","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/101789","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-3129","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3129","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2017-11512","name":"ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval","severity":"high","path":"http/cves/2017/CVE-2017-11512.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-11512.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2017-11-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2017-11512","provenance":"source"},{"date":"2022-01-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.checkpoint.com/security/december-2021s-most-wanted-malware-trickbot-emotet-and-the-log4j-plague/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":59.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1751 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9960"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}