CVE-2019-10273

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus version 9.3

Description The issue is related to information leakage in the "/mc login" API endpoint, allowing authenticated users to enumerate active users due to a flaw in authentication handling. This enables an attacker to login and verify any active account.

Recommendations For ManageEngine ServiceDesk Plus version 9.3, consider restricting access to the "/mc login" API endpoint until a patch is available. As a temporary workaround, limit the ability of authenticated users to enumerate active users by implementing additional authentication or authorization checks.