vulnerability

Zoho ManageEngine ServiceDesk Plus MSP: CVE-2025-3444: Authenticated LFI Vulnerability

Try Surface Command

Back to search

Severity	CVSS	Published	Added	Modified
7	(AV:N/AC:L/Au:S/C:C/I:N/A:N)	Apr 10, 2025	May 22, 2025	Jul 2, 2025

Severity

CVSS

(AV:N/AC:L/Au:S/C:C/I:N/A:N)

Published

Apr 10, 2025

Added

May 22, 2025

Modified

Jul 2, 2025

Description

ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion LFI in the Admin module, where help card content is loaded.

Solution

zoho-manageengine-servicedesk-plus-msp-upgrade-latest

References

CWE-434
CVE-2025-3444
https://attackerkb.com/topics/CVE-2025-3444
URL-https://www.manageengine.com/products/service-desk-msp/cve-2025-3444.html

NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today