There is an improper privilege management vulnerability identified in ManageEngine’s Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before 14940.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.1 | CVE-2025-8309 |
Exploitation
To exploit this vulnerability, an attacker can leverage the improper privilege management in the affected ManageEngine products. By sending specially crafted requests over the network, the attacker can gain unauthorized access to sensitive functionalities and data, potentially leading to further exploitation of the system.
Affected Products
- Asset Explorer: Affected versions are those prior to 7710, which may allow unauthorized access due to privilege mismanagement.
- ServiceDesk Plus: Versions before 15110 are vulnerable, enabling attackers to exploit privilege issues.
- ServiceDesk Plus MSP: Vulnerable versions are those before 14940, which can be exploited for unauthorized actions.
- SupportCenter Plus: Versions prior to 14940 are affected, allowing for potential privilege escalation.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest versions of the affected products as specified by ManageEngine. Regularly applying security patches and monitoring for unusual activity can also help reduce the risk of exploitation.