Authenticated Local File Inclusion in ManageEngine ServiceDesk Plus MSP and SupportCenter Plus
CVE-2025-3444

6.5MEDIUM

Key Information:

Vendor

Manageengine
Status
Servicedesk Plus Msp
Supportcenter Plus
Vendor
CVE Published:
22 May 2025

What is CVE-2025-3444?

The authenticated Local File Inclusion (LFI) vulnerability in ManageEngine ServiceDesk Plus MSP and SupportCenter Plus allows attackers to exploit the Admin module. When help card content is loaded, unauthorized files from the server can be included, potentially leading to sensitive information disclosure. This vulnerability affects versions prior to 14920, making it crucial for users to apply recommended patches to secure their systems.

Affected Version(s)

ServiceDesk Plus MSP 0 < 14920

SupportCenter Plus 0 < 14920

References

https://www.manageengine.com/products/service-desk-msp/cv...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Esther
JSON
.