{"id":"CVE-2019-8394","kind":"vulnerability","aliases":["CVE-2019-8394"],"related":[],"title":"Zoho ManageEngine: Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability","description":"Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Zoho ManageEngine ServiceDesk Plus (SDP) has an unspecified flaw in login page customization that lets remote users upload files. An attacker who can reach the login page can place files on the server, which typically leads to code execution, though the sources do not state the exact impact.","severity":"high","cvss":7.5,"epss":0.63336,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Zoho ManageEngine","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","self-hosted","servicedesk-plus","vendor","zoho-manageengine"],"not_affected_if":["managed-hosting","not-servicedesk-plus"],"how_to_check":null,"fix":"Apply the vendor update per Zoho ManageEngine instructions (CISA required action); the affected and fixed versions are not stated in the sources.","status":"open","published_at":"2019-02-17T04:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:43+00:00","updated_at":"2026-10-23T20:29:43+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:29:43Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Zoho ManageEngine instructions (CISA required action); the affected and fixed versions are not stated in the sources.","summary":"Zoho ManageEngine ServiceDesk Plus (SDP) has an unspecified flaw in login page customization that lets remote users upload files. An attacker who can reach the login page can place files on the server, which typically leads to code execution, though the sources do not state the exact impact.","category":"vendor","who_cares":["zoho-manageengine","servicedesk-plus","self-hosted"],"confidence":0.6,"analyst_note":"Find affected and fixed SDP build numbers and the vendor advisory from the NVD reference and Zoho ManageEngine security page; confirm whether the login page customization feature is required for exploitation.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","not-servicedesk-plus"],"severity_if_unknown":"high"},"cost_usd":0.000378,"input_tokens":2115,"output_tokens":332,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2019':12A,15A '-8394':13A,16A 'action':100C 'allow':88C 'appli':101C 'attack':50B 'cisa':98C 'code':67B 'contain':83C 'custom':42B,97C 'cve':11A,14A 'exact':76B 'execut':68B 'exploit':19B 'file':8A,48B,59B,93C 'flaw':38B 'host':22B 'impact':77B 'instruct':105C 'lead':65B 'let':44B 'login':40B,55B,95C 'manageengin':2A,4A,29B,31B,79C 'manageengine':18A 'page':41B,56B,96C 'per':103C 'place':58B 'plus':6A,25B,33B,81C 'reach':53B 'remot':45B,89C 'requir':99C 'sdp':7A,34B,82C 'self':21B 'self-host':20B 'server':62B 'servicedesk':5A,24B,32B,80C 'servicedesk-plus':23B 'sourc':71B 'state':74B 'though':69B 'typic':64B 'unspecifi':37B,85C 'updat':102C 'upload':9A,47B,92C 'user':46B,90C 'vendor':26B,104C 'via':94C 'vulner':10A,86C 'zoho':1A,3A,17A,28B,30B,78C 'zoho-manageengin':27B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-02-17T04:29:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-8394","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-8394","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:18+00:00","note":null},{"source":"epss","external_id":"CVE-2019-8394","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-8394","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-8394","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8394","severity":null,"published_at":"2019-02-17T04:29:00+00:00","modified_at":"2026-06-17T02:41:56+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}