{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-03T13:37:56.091","vulnerabilities":[{"cve":{"id":"CVE-2019-8394","sourceIdentifier":"cve@mitre.org","published":"2019-02-17T04:29:00.330","lastModified":"2026-06-17T02:41:56.683","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization."},{"lang":"es","value":"Zoho ManageEngine ServiceDesk Plus (SDP), en versiones anteriores a la 10.0 build 10012, permite que los atacantes remotos suban archivos arbitrarios mediante la personalización de la página de inicio."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-04T20:23:35.077619Z","id":"CVE-2019-8394","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2021-11-03","cisaActionDue":"2022-05-03","cisaRequiredAction":"Apply updates per vendor instructions.","cisaVulnerabilityName":"Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability","weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-434"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.0","matchCriteriaId":"4EAFC388-E113-4972-8B2F-B5E2DE249A7E"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:-:*:*:*:*:*:*","matchCriteriaId":"97CABEC7-2B76-4B17-B906-1CB2B49515A1"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10000:*:*:*:*:*:*","matchCriteriaId":"B8254ACB-5C97-4C05-A3DC-E28428DFB3B5"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10001:*:*:*:*:*:*","matchCriteriaId":"1F68FFBD-EFD8-4DC7-BBBF-53C37B58C075"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10002:*:*:*:*:*:*","matchCriteriaId":"B8EF8D0F-F50E-4C22-8B41-BD2D5F4DBE41"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10003:*:*:*:*:*:*","matchCriteriaId":"548CAD7B-9738-4764-84F3-8D7EFFB0F7EC"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10004:*:*:*:*:*:*","matchCriteriaId":"01754D60-5592-4193-A2DF-4CE12D30CF24"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10005:*:*:*:*:*:*","matchCriteriaId":"DC5B570B-8C33-448C-84D9-BC9D5F9FEACD"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10006:*:*:*:*:*:*","matchCriteriaId":"21DC1DA3-012F-4AF2-B6CA-968E50A503EC"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10007:*:*:*:*:*:*","matchCriteriaId":"9DE94B05-7B6A-4912-8590-D9C1791F9B68"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10008:*:*:*:*:*:*","matchCriteriaId":"16C27699-4157-4473-9FB3-01151B3E21F3"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10009:*:*:*:*:*:*","matchCriteriaId":"F9AC6EC8-E1CA-4889-8AF8-482649CF2139"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10010:*:*:*:*:*:*","matchCriteriaId":"4186B73E-0E0F-48E1-9A51-B90E228BDA14"},{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10011:*:*:*:*:*:*","matchCriteriaId":"9CA6C73A-F3DE-469B-9F1E-6B9037F3F6F8"}]}]}],"references":[{"url":"http://www.securityfocus.com/bid/107129","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46413/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.manageengine.com/products/service-desk/readme.html","source":"cve@mitre.org","tags":["Release Notes","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/107129","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46413/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.manageengine.com/products/service-desk/readme.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8394","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}}]}