Description
ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie.
References
- 93216 vdb-entry
- JVNDB-2016-000171 third-party-advisory
- JVN#72559412 third-party-advisory
- https://www.manageengine.com/products/service-desk/readme-9.2.html