ID de Prueba:	1.3.6.1.4.1.25623.1.0.801984
Categoría:	Web application abuses
Título:	ManageEngine ServiceDesk Plus Authentication Bypass Vulnerability
Resumen:	ManageEngine ServiceDesk Plus is prone to an authentication bypass vulnerability.
Descripción:	Summary: ManageEngine ServiceDesk Plus is prone to an authentication bypass vulnerability. Vulnerability Insight: The flaw is due to an error in authentication process, User passwords are pseudo encrypted and locally stored in user cookies. Having Javascript code encrypt and decrypt passwords in Login.js file. Vulnerability Impact: Successful exploitation will allow attacker to get user names and passwords of registered users. This may allow an attacker to steal cookie-based authentications and launch further attacks. Affected Software/OS: ManageEngine ServiceDesk Plus 8.0 Build 8013 and prior. Solution: Vendor has released a patch to fix this issue, please refer below link for more information. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1509 BugTraq ID: 49636 http://www.securityfocus.com/bid/49636 Bugtraq: 20110914 CORE-2011-0506 - Multiples Vulnerabilities in ManageEngine ServiceDesk Plus (Google Search) http://www.securityfocus.com/archive/1/519652/100/0/threaded http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp http://securityreason.com/securityalert/8385 XForce ISS Database: servicedesk-loginjs-security-bypass(69841) https://exchange.xforce.ibmcloud.com/vulnerabilities/69841
Copyright	Copyright (C) 2011 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.