Vulnerability record · CVE-2019-10008 · published 24 April 2019
CVE-2019-10008: Zohocorp servicedesk plus vulnerability
Zohocorp · Servicedesk Plus
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.
Description
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.exploit-db.com/exploits/46659 | ExploitThird Party AdvisoryVDB Entry |
| https://www.manageengine.com/products/service-desk/readme.html | Release NotesVendor Advisory |
| https://www.exploit-db.com/exploits/46659 | ExploitThird Party AdvisoryVDB Entry |
| https://www.manageengine.com/products/service-desk/readme.html | Release NotesVendor Advisory |
Track CVE-2019-10008 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-10008), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
