CVE-2025-3444 MEDIUM

CVE-2025-3444: Local File Inclusion

Vendor Manageengine
Product ServiceDesk Plus MSP
Weakness CWE-434 · Unrestricted file upload
Published May 22, 2025
Last update May 22, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.

Key dates

02Disclosure timeline

May 22, 2025 CVE published
May 22, 2025 Record updated