CVE-2016-4890 in ServiceDesk Plus

Resumen

por MITRE

ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generationg cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Reservar: 2016-05-17
• Divulgación: 2017-04-14
• Moderación: aceptado
• Artículo: VDB-99883
• CPE: listo
• CWE: CWE-254 (confirmado)
• CVSS: 5.3 (NVD)
• EPSS: 0.03000
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2016-4890
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-4890
• CVE Details: https://www.cvedetails.com/cve/CVE-2016-4890/