Authenticated Local File Inclusion in ManageEngine ServiceDesk Plus MSP and SupportCenter Plus
CVE-2025-3444
6.5MEDIUM
Key Information:
- Vendor
Manageengine
- Vendor
- CVE Published:
- 22 May 2025
What is CVE-2025-3444?
The authenticated Local File Inclusion (LFI) vulnerability in ManageEngine ServiceDesk Plus MSP and SupportCenter Plus allows attackers to exploit the Admin module. When help card content is loaded, unauthorized files from the server can be included, potentially leading to sensitive information disclosure. This vulnerability affects versions prior to 14920, making it crucial for users to apply recommended patches to secure their systems.
Affected Version(s)
ServiceDesk Plus MSP 0 < 14920
SupportCenter Plus 0 < 14920