Security advisory

Authenticated user privilege escalation vulnerability via insecure regex in URL paths

CVE ID : CVE-2025-8309

Product Name Severity Affected Version(s) Fixed Version Fixed On
AssetExplorer High 7700 and below 7710 August 05, 2025
ServiceDesk Plus High 15100 and below 15110 August 05, 2025
ServiceDesk Plus MSP High 14930 and below 14940 August 12, 2025
SupportCenter Plus High 14930 and below 14940 August 12, 2025

Details

A privilege escalation vulnerability caused by the overly permissive regular expression (regex) rules in URL mapping could be exploited to incorrectly match servlet paths using wildcards.

Impact

Allows an authenticated, low-privileged user to take control of any account, including administrator accounts, potentially leading to data exposure and unauthorized actions. To exploit this vulnerability, the threat actor must first compromise a low-privileged user account within the application.

However, this vulnerability is not applicable if local authentication is disabled. Additionally, high-privileged user accounts associated with an email ID cannot be compromised through this method.

How was it resolved?

Stricter URL path validation was implemented to prevent unauthorized access, and unused API servlet classes along with their URL mappings were removed.

Steps to upgrade

  1. Download the latest service packs from the following links:
  2. Apply the latest build to your existing product installation as per the service pack instructions provided in the above link.

Acknowledgements

This vulnerability was reported by @devme4f from VNPT-VCI through our bug bounty program.

If you have any questions or concerns, please contact our product support teams at the below-mentioned email addresses.

AssetExplorer: assetexplorer-support@manageengine.com

ServiceDesk Plus: support@servicedeskplus.com

ServiceDesk Plus MSP: support@servicedeskplusmsp.com

SupportCenter Plus: support@supportcenterplus.com

Let's support faster, easier, and together