CVE-2019-12252

—

CVSS 3.1

6.5 medium

EPSS

8%p95

Published

May 21, 2019 (May 21, 2019)

Modified

Jun 17, 2026

Description

In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring.

Vendors: zohocorp
Products: manageengine servicedesk plus
Weakness: CWE-639
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (8.4%)

In the news0 stories

No ingested article mentions this CVE yet.